Casbin 3.11.0

Apply the Go 1.27 baseline first. These rules cover the Casbin for Go v3 module, authorization models, policy persistence, transactions, caches, distributed synchronization, and the optional AI explanation API.

Version and module boundary

• Import github.com/casbin/casbin/v3, record it in go.mod and go.sum, and treat every Casbin upgrade as an authorization change that reruns your decision tests; Casbin publishes no maintenance promise for older releases, so fixes come in newer v3 releases. Do not accidentally retain v2 imports, adapters, wrappers, or duplicate enforcer instances during migration.
• Inventory and independently pin every adapter, watcher, dispatcher, custom matcher function, and management service because the Casbin core version does not establish their security or compatibility.
• Treat the v2-to-v3 module-path change as an authorization migration: stage the exact model and policy, compare decisions on representative traffic, and make rollback restore the matching binary, model, adapter, and policy generation.
• Use Casbin only for authorization. Authenticate identities, validate sessions and credentials, establish tenant context, and resolve resource ownership before constructing the enforcement request.

Model, matcher, and effect integrity

• Store model files as reviewed, immutable deployment artifacts and restrict changes to request definitions, policy definitions, role definitions, effects, matchers, and named models as privileged code changes.
• For allow/deny models, require an allow with some(where (p.eft == allow)), or