openedx-authz 2.2.0__tar.gz → 2.4.0__tar.gz

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/CHANGELOG.rst

@@ -18,8 +18,8 @@ Added
 =====
 
 * Added the static authorization schema, a versioned YAML format for declaring permissions,
-  permission categories, roles, and role extensions (ADR 0017). The permissions and roles that
-  ``authz.policy`` defines are now also expressed as schema files under
+  permission categories, roles, and role extensions (ADR 0017). The permissions and roles
+  previously defined in ``authz.policy`` are expressed as schema files under
   ``openedx_authz/authz/schema/``.
 * Added the schema loading pipeline in ``openedx_authz/engine/schema/``, covering the discover,
   load, validate and compile phases of the lifecycle (ADR 0018), plus render and apply in
@@ -61,11 +61,18 @@ Fixed
   by priority. This aligns the compiler with ADR 0031 and removes a path where a higher-priority file
   could silently replace a role's base definition.
 
+Changed
+========
+
+* Removed ``authz.policy`` after moving its static role-permission policies to the authorization schema. Existing Casbin action grouping remains supported until permission dependencies move to the schema.
+* Calls to the deprecated ``load_policies`` command without an explicit policy file are now a no-op while deployment integrations move to ``load_authz_schema``.
+
 Notes
 =====
 
-* No authorization behavior changes in this release. Loading ``authz.policy`` works as before, and
-  the new pipeline runs only when ``load_authz_schema`` is invoked.
+* Existing custom policy files can still be loaded by passing their path to ``load_policies``.
+  Calls without a policy file do nothing while deployment integrations move to
+  ``load_authz_schema``.
 * Applying a schema is idempotent and preserves data the loader does not own: user assignments,
   dynamic roles, legacy ``g2`` action-inheritance rows, and pre-existing policy rows that no schema
   declares. Rows that already exist are adopted, gaining definition and source records rather than

{openedx_authz-2.2.0/src/openedx_authz.egg-info → openedx_authz-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openedx-authz
-Version: 2.2.0
+Version: 2.4.0
 Summary: Open edX AuthZ provides the architecture and foundations of the authorization framework.
 Author-email: Open edX Project <oscm@openedx.org>
 License-Expression: AGPL-3.0-or-later
@@ -55,7 +55,7 @@ Integration with edx-platform
 
 This repository became an edx-platform's dependency starting with the Ulmo release. From that release onwards, system policies are automatically updated.
 
-If you need to update the policies manually, it is recommended to use the ``./manage.py lms load_policies`` command.
+To update the static authorization definitions manually, run ``./manage.py lms load_authz_schema``.
 
 .. note::
     Currently, this package only supports the `content libraries' roles and permissions as documented here`_, and the migration of data from the old system to the new one is performed automatically.

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/README.rst

@@ -18,7 +18,7 @@ Integration with edx-platform
 
 This repository became an edx-platform's dependency starting with the Ulmo release. From that release onwards, system policies are automatically updated.
 
-If you need to update the policies manually, it is recommended to use the ``./manage.py lms load_policies`` command.
+To update the static authorization definitions manually, run ``./manage.py lms load_authz_schema``.
 
 .. note::
     Currently, this package only supports the `content libraries' roles and permissions as documented here`_, and the migration of data from the old system to the new one is performed automatically.

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/docs/decisions/0022-defer-authorization-implications.rst

@@ -45,6 +45,13 @@ Consequences
 * The current policy loader continues to handle existing Casbin grouping rows.
 * Introducing implication later requires a schema-version change and migration guidance.
 
+Addendum: Remove the Static Policy File (2026-11-03)
+=====================================================
+
+Static role-permission policies moved from ``authz.policy`` to the authorization schema, and the policy file was removed. The Casbin ``g2`` model, matcher behavior, and stored grouping rows remain unchanged.
+
+New installations no longer load the default ``g2`` relationships that were stored in ``authz.policy``. `Issue #91`_ and `Issue #523`_ track defining permission dependencies in the authorization schema.
+
 Rejected Alternatives
 *********************
 
@@ -62,5 +69,9 @@ References
 **********
 
 * `ADR 0017`_
+* `Issue #91`_
+* `Issue #523`_
 
 .. _ADR 0017: 0017-static-authorization-schema.rst
+.. _Issue #91: https://github.com/openedx/openedx-authz/issues/91
+.. _Issue #523: https://github.com/openedx/openedx-authz/issues/523

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/authz/schema/course_permissions.yaml

@@ -56,7 +56,7 @@ permission_categories:
     description: Additional permissions not included in other categories, such as viewing checklists.
     icon: DrawShapes
   # Backend-only category for legacy compatibility actions that have no frontend
-  # display metadata. These are referenced by legacy roles in authz.policy.
+  # display metadata. These are referenced by legacy roles in course_roles.yaml.
   - id: course_legacy
     display_name: Legacy compatibility
     description: Internal compatibility permissions that map legacy course roles to the authorization system. Not shown as individually assignable permissions.

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/authz/schema/course_roles.yaml

@@ -88,7 +88,6 @@ roles:
     description: Can create and edit course content, but cannot publish or change critical course settings.
     scopes:
       - course-v1
-    hidden: true
     permissions:
       - courses.view_course
       - courses.view_course_updates
@@ -118,7 +117,6 @@ roles:
     description: Can view course content and settings, but cannot make changes.
     scopes:
       - course-v1
-    hidden: true
     permissions:
       - courses.view_course
       - courses.view_course_updates

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/engine/renderer.py

@@ -7,7 +7,7 @@ the ``render`` and ``apply`` lifecycle steps:
   memory, without touching the database.
 * ``apply`` persists the rows in a single transaction, while preserving data
   owned by other services (ADR 0018 §3): dynamic roles, user assignments, and
-  the legacy ``g2`` action-inheritance rows that still live in ``authz.policy``.
+  legacy ``g2`` action-inheritance rows.
 
 Key semantics:
     * Idempotent (ADR 0018 §2): re-applying identical definitions changes

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/management/commands/load_policies.py

@@ -1,7 +1,7 @@
 """Django management command to load policies into the authz Django model.
 
 The command supports:
-- Specifying the path to the Casbin policy file. Default is 'openedx_authz/engine/config/authz.policy'.
+- Specifying the path to a Casbin policy file. Calls without a file are a no-op.
 - Specifying the Casbin model configuration file. Default is 'openedx_authz/engine/config/model.conf'.
 - Optionally clearing existing policies in the database before loading new ones.
 """
@@ -25,9 +25,8 @@ class Command(BaseCommand):
     and persistence of authorization policies within the Django application.
 
     Example Usage:
-        python manage.py load_policies --policy-file-path /path/to/authz.policy
-        python manage.py load_policies --policy-file-path /path/to/authz.policy --model-file-path /path/to/model.conf
-        python manage.py load_policies
+        python manage.py load_policies --policy-file-path /path/to/custom.policy
+        python manage.py load_policies --policy-file-path /path/to/custom.policy --model-file-path /path/to/model.conf
     """
 
     help = "Load policies from a Casbin policy file into the Django database model."
@@ -74,7 +73,13 @@ class Command(BaseCommand):
             options["model_file_path"],
         )
         if policy_file_path is None:
-            policy_file_path = os.path.join(ROOT_DIRECTORY, "engine", "config", "authz.policy")
+            self.stdout.write(
+                self.style.WARNING(
+                    "No policy file supplied; nothing was loaded. "
+                    "Use load_authz_schema for static role-permission policies."
+                )
+            )
+            return
         if model_file_path is None:
             model_file_path = os.path.join(ROOT_DIRECTORY, "engine", "config", "model.conf")
 

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/tests/api/test_roles.py

@@ -5,10 +5,8 @@ including role creation, assignment, permission management, and querying
 roles and permissions within specific scopes.
 """
 
-from importlib.resources import files
 from unittest.mock import patch
 
-import casbin
 from ddt import data as ddt_data
 from ddt import ddt, unpack
 from django.test import TestCase
@@ -50,8 +48,8 @@ from openedx_authz.constants.roles import (
     LIBRARY_USER_PERMISSIONS,
 )
 from openedx_authz.engine.enforcer import AuthzEnforcer
-from openedx_authz.engine.utils import migrate_policy_between_enforcers
 from openedx_authz.models import ExtendedCasbinRule, Scope, Subject
+from openedx_authz.tests.test_utils import seed_static_authorization_policies
 
 
 def _mock_get_or_create_scope(scope_data):
@@ -76,20 +74,14 @@ class BaseRolesTestCase(TestCase):
 
     @classmethod
     def _seed_database_with_policies(cls):
-        """Seed the database with policies from the policy file.
+        """Seed the database with policies from the authorization schema.
 
         This simulates the one-time database seeding that would happen
         during application deployment, separate from the runtime policy loading.
         """
         global_enforcer = AuthzEnforcer.get_enforcer()
         global_enforcer.load_policy()
-        model_path = str(files("openedx_authz.engine").joinpath("config/model.conf"))
-        policy_path = str(files("openedx_authz.engine").joinpath("config/authz.policy"))
-
-        migrate_policy_between_enforcers(
-            source_enforcer=casbin.Enforcer(model_path, policy_path),
-            target_enforcer=global_enforcer,
-        )
+        seed_static_authorization_policies(global_enforcer)
         global_enforcer.clear_policy()  # Clear to simulate fresh start for each test
 
     @classmethod
@@ -181,7 +173,7 @@ class RolesTestSetupMixin(BaseRolesTestCase):
         super().setUpClass()
         # Define specific assignments for this test class
         assignments = [
-            # Basic library roles from authz.policy
+            # Basic library roles from the authorization schema
             {
                 "subject_name": "alice",
                 "role_name": roles.LIBRARY_ADMIN.external_key,
@@ -202,7 +194,7 @@ class RolesTestSetupMixin(BaseRolesTestCase):
                 "role_name": roles.LIBRARY_USER.external_key,
                 "scope_name": "lib:Org1:english_101",
             },
-            # Basic course roles from authz.policy
+            # Basic course roles from the authorization schema
             {
                 "subject_name": "daniel",
                 "role_name": roles.COURSE_STAFF.external_key,
@@ -430,17 +422,17 @@ class TestRolesAPI(RolesTestSetupMixin):
             self.assertFalse(ExtendedCasbinRule.objects.filter(subject=subj_obj, scope=scope_obj).exists())
 
     @ddt_data(
-        # Library Admin role with actual permissions from authz.policy
+        # Library Admin role with permissions from the authorization schema
         (
             roles.LIBRARY_ADMIN.external_key,
             LIBRARY_ADMIN_PERMISSIONS,
         ),
-        # Library Author role with actual permissions from authz.policy
+        # Library Author role with permissions from the authorization schema
         (
             roles.LIBRARY_AUTHOR.external_key,
             LIBRARY_AUTHOR_PERMISSIONS,
         ),
-        # Library Contributor role with actual permissions from authz.policy
+        # Library Contributor role with permissions from the authorization schema
         (
             roles.LIBRARY_CONTRIBUTOR.external_key,
             LIBRARY_CONTRIBUTOR_PERMISSIONS,
@@ -466,7 +458,7 @@ class TestRolesAPI(RolesTestSetupMixin):
         """
         assigned_permissions = get_permissions_for_single_role(RoleData(external_key=role_name))
 
-        self.assertEqual(assigned_permissions, expected_permissions)
+        self.assertEqual(sorted(assigned_permissions, key=str), sorted(expected_permissions, key=str))
 
     @ddt_data(
         # Role assigned to multiple users in different scopes
@@ -502,8 +494,8 @@ class TestRolesAPI(RolesTestSetupMixin):
 
         self.assertIn(role_name, assigned_permissions)
         self.assertEqual(
-            assigned_permissions[role_name]["permissions"],
-            expected_permissions,
+            sorted(assigned_permissions[role_name]["permissions"], key=str),
+            sorted(expected_permissions, key=str),
         )
 
     @ddt_data(
@@ -544,14 +536,17 @@ class TestRolesAPI(RolesTestSetupMixin):
         """Test retrieving role definitions from policy for a namespace wildcard scope.
 
         Expected result:
-            - Role definitions defined in authz.policy for the scope are returned.
+            - Role definitions defined in the authorization schema for the scope are returned.
             - Each role includes the permissions declared in its policy rules.
         """
         roles_in_scope = get_role_definitions_in_scope(ScopeData(namespaced_key=namespaced_scope))
         roles_by_key = {role.external_key: role for role in roles_in_scope}
 
         self.assertEqual(set(roles_by_key.keys()), expected_roles)
-        self.assertEqual(roles_by_key[sample_role].permissions, expected_permissions)
+        self.assertEqual(
+            sorted(roles_by_key[sample_role].permissions, key=str),
+            sorted(expected_permissions, key=str),
+        )
 
     def test_get_role_definitions_in_scope_returns_empty_for_concrete_scope(self):
         """Concrete scopes do not match namespace wildcard policy definitions."""

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/tests/integration/test_views.py

@@ -1,10 +1,8 @@
 """Integration tests for openedx_authz views."""
 
-import os
 import uuid
 from urllib.parse import urlencode
 
-import casbin
 import pytest
 from django.contrib.auth import get_user_model
 from django.test import TestCase
@@ -12,12 +10,11 @@ from django.urls import reverse
 from rest_framework import status
 from rest_framework.test import APIClient
 
-from openedx_authz import ROOT_DIRECTORY
 from openedx_authz.api.users import assign_role_to_user_in_scope
 from openedx_authz.engine.enforcer import AuthzEnforcer
-from openedx_authz.engine.utils import migrate_policy_between_enforcers
 from openedx_authz.models.core import ExtendedCasbinRule
 from openedx_authz.tests.integration.test_models import create_test_library
+from openedx_authz.tests.test_utils import seed_static_authorization_policies
 
 User = get_user_model()
 
@@ -30,19 +27,10 @@ class TestRoleAssignmentView(TestCase):
     def setUpClass(cls):
         """Set up test class - seed database with policies."""
         super().setUpClass()
-        # Seed the database with policies from the policy file
-        # This loads the policy definitions (p, g rules) that define what permissions each role has
+        # Seed the database with policies from the authorization schema
         global_enforcer = AuthzEnforcer.get_enforcer()
         global_enforcer.load_policy()
-
-        # Use absolute paths based on the package ROOT_DIRECTORY
-        model_conf = os.path.join(ROOT_DIRECTORY, "engine", "config", "model.conf")
-        authz_policy = os.path.join(ROOT_DIRECTORY, "engine", "config", "authz.policy")
-
-        migrate_policy_between_enforcers(
-            source_enforcer=casbin.Enforcer(model_conf, authz_policy),
-            target_enforcer=global_enforcer,
-        )
+        seed_static_authorization_policies(global_enforcer)
 
     def setUp(self):
         """Set up the test client and any required data."""

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/tests/rest_api/test_views.py

@@ -1559,7 +1559,7 @@ class TestArbitraryRoleSupport(ViewTestMixin):
     def setUpClass(cls):
         super().setUpClass()
         # Defined with the same wildcard library scope as the built-in library roles
-        # (see authz.policy), so it's visible for any specific library scope.
+        # (see library_roles.yaml), so it's visible for any specific library scope.
         AuthzEnforcer.get_enforcer().add_policy(
             make_role_key(cls.CUSTOM_ROLE),
             make_action_key(cls.CUSTOM_ACTION),

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/tests/test_commands.py

@@ -15,7 +15,6 @@ from ddt import data, ddt
 from django.core.management import call_command
 from django.core.management.base import CommandError
 
-from openedx_authz import ROOT_DIRECTORY
 from openedx_authz import api as authz_api
 from openedx_authz.api.data import ContentLibraryData
 from openedx_authz.constants.permissions import (
@@ -334,7 +333,7 @@ class LoadPoliciesCommandTests(TestCase):
     Tests for the `load_policies` Django management command.
 
     This test class verifies the behavior of the load_policies command, including:
-    - Default file path handling
+    - Missing policy file handling
     - Clearing existing policies
     """
 
@@ -343,43 +342,14 @@ class LoadPoliciesCommandTests(TestCase):
         self.buffer = io.StringIO()
 
     @patch("openedx_authz.engine.enforcer.AuthzEnforcer.get_enforcer")
-    @patch("casbin.Enforcer")
-    @patch("os.path.join")
-    @patch("click.confirm")
-    def test_handle_with_default_paths(self, mock_confirm, mock_join, mock_casbin_enforcer, mock_get_enforcer):
-        """Test handle method with default policy and model paths."""
-        # Setup mocks
-        mock_target_enforcer = Mock()
-        mock_get_enforcer.return_value = mock_target_enforcer
-
-        mock_source_enforcer = Mock()
-        mock_casbin_enforcer.return_value = mock_source_enforcer
-
-        policy_path = f"{ROOT_DIRECTORY}/engine/config/authz.policy"
-        model_path = f"{ROOT_DIRECTORY}/engine/config/model.conf"
-
-        # Define paths that will be joined
-        mock_join.side_effect = (
-            policy_path,
-            model_path,
-        )
-
-        # Create command instance
-        command = LoadPoliciesCommand()
-        command.migrate_policies = Mock()
+    def test_handle_without_policy_file_is_a_deprecated_noop(self, mock_get_enforcer):
+        """Existing deployment calls remain safe until they move to the schema command."""
+        command = LoadPoliciesCommand(stdout=self.buffer)
 
-        # Call handle method
         command.handle(policy_file_path=None, model_file_path=None, clear_existing=False)
 
-        # Assertions
-        mock_casbin_enforcer.assert_called_once_with(
-            model_path,
-            policy_path,
-        )
-        mock_join.assert_any_call(ROOT_DIRECTORY, "engine", "config", "authz.policy")
-        mock_join.assert_any_call(ROOT_DIRECTORY, "engine", "config", "model.conf")
-        mock_confirm.assert_not_called()
-        command.migrate_policies.assert_called_once_with(mock_source_enforcer, mock_target_enforcer)
+        self.assertIn("No policy file supplied", self.buffer.getvalue())
+        mock_get_enforcer.assert_not_called()
 
     @patch("openedx_authz.engine.enforcer.AuthzEnforcer.get_enforcer")
     @patch("casbin.Enforcer")
@@ -439,7 +409,7 @@ class LoadPoliciesCommandTests(TestCase):
         command._delete_permissions_inheritance = Mock()
 
         # Call handle method
-        command.handle(policy_file_path=None, model_file_path=None, clear_existing=True)
+        command.handle(policy_file_path="/custom/policy.csv", model_file_path=None, clear_existing=True)
 
         # Assertions
         mock_target_enforcer.load_policy.assert_called_once()
@@ -474,7 +444,7 @@ class LoadPoliciesCommandTests(TestCase):
         command._delete_permissions_inheritance = Mock()
 
         # Call handle method
-        command.handle(policy_file_path=None, model_file_path=None, clear_existing=True)
+        command.handle(policy_file_path="/custom/policy.csv", model_file_path=None, clear_existing=True)
 
         # Assertions
         mock_target_enforcer.load_policy.assert_called_once()
@@ -506,7 +476,7 @@ class LoadPoliciesCommandTests(TestCase):
         command._delete_permissions_inheritance = Mock()
 
         # Call handle method
-        command.handle(policy_file_path=None, model_file_path=None, clear_existing=True)
+        command.handle(policy_file_path="/custom/policy.csv", model_file_path=None, clear_existing=True)
 
         # Assertions
         mock_target_enforcer.load_policy.assert_called_once()

{openedx_authz-2.2.0 → openedx_authz-2.4.0}/src/openedx_authz/tests/test_enforcer.py

@@ -5,36 +5,35 @@ including filtered loading, scope-based loading, and lifecycle management
 that would be used in production environments.
 """
 
-import os
 import time
 from uuid import uuid4
 
-import casbin
 from ddt import data as ddt_data
 from ddt import ddt
 from django.conf import settings
 from django.test import TestCase, TransactionTestCase, override_settings
 
-from openedx_authz import ROOT_DIRECTORY
 from openedx_authz.engine.enforcer import AuthzEnforcer
 from openedx_authz.engine.filter import Filter
-from openedx_authz.engine.utils import migrate_policy_between_enforcers
 from openedx_authz.models.engine import PolicyCacheControl
-from openedx_authz.tests.test_utils import make_action_key, make_role_key, make_scope_key, make_user_key
-
-MODEL_CONF_PATH = os.path.join(ROOT_DIRECTORY, "engine", "config", "model.conf")
-AUTHZ_POLICY_PATH = os.path.join(ROOT_DIRECTORY, "engine", "config", "authz.policy")
+from openedx_authz.tests.test_utils import (
+    AuthzEnforcerTestMixin,
+    make_action_key,
+    make_role_key,
+    make_scope_key,
+    make_user_key,
+    seed_static_authorization_policies,
+)
 
 
 class PolicyLoadingTestSetupMixin(TestCase):
     """Mixin providing policy loading test utilities."""
 
-    @staticmethod
-    def _count_policies_in_file(scope_pattern: str = None, role: str = None):
-        """Count policies in the authz.policy file matching the given criteria.
+    def _count_schema_policies(self, scope_pattern: str = None, role: str = None):
+        """Count schema policies matching the given criteria.
 
         This provides a dynamic way to get expected policy counts without
-        hardcoding values that might change as the policy file evolves.
+        hardcoding values that might change as the schema evolves.
 
         Args:
             scope_pattern: Scope pattern to match (e.g., 'lib^*')
@@ -43,32 +42,14 @@ class PolicyLoadingTestSetupMixin(TestCase):
         Returns:
             int: Number of matching policies
         """
-        count = 0
-        with open(AUTHZ_POLICY_PATH, "r") as f:
-            for line in f:
-                line = line.strip()
-                if not line or line.startswith("#"):
-                    continue
-                if not line.startswith("p,"):
-                    continue
-
-                parts = [p.strip() for p in line.split(",")]
-                if len(parts) < 4:
-                    continue
-
-                # parts[0] = 'p', parts[1] = role, parts[2] = action, parts[3] = scope
-                matches = True
-                if role and parts[1] != role:
-                    matches = False
-                if scope_pattern and parts[3] != scope_pattern:
-                    matches = False
-
-                if matches:
-                    count += 1
-        return count
+        return sum(
+            1
+            for policy in self.schema_policies
+            if (not role or policy[0] == role) and (not scope_pattern or policy[2] == scope_pattern)
+        )
 
     def _seed_database_with_policies(self):
-        """Seed the database with policies from the policy file.
+        """Seed the database with policies from the authorization schema.
 
         This simulates the one-time database seeding that would happen
         during application deployment, separate from runtime policy loading.
@@ -77,13 +58,7 @@ class PolicyLoadingTestSetupMixin(TestCase):
         global_enforcer = AuthzEnforcer.get_enforcer()
         global_enforcer.clear_policy()
 
-        migrate_policy_between_enforcers(
-            source_enforcer=casbin.Enforcer(
-                MODEL_CONF_PATH,
-                AUTHZ_POLICY_PATH,
-            ),
-            target_enforcer=global_enforcer,
-        )
+        self.schema_policies = seed_static_authorization_policies(global_enforcer)
         # Ensure enforcer memory is clean for test isolation
         global_enforcer.clear_policy()
 
@@ -169,7 +144,7 @@ class TestPolicyLoadingStrategies(PolicyLoadingTestSetupMixin):
 
     These tests demonstrate how policy loading would work in real-world scenarios,
     including scope-based loading, user-context loading, and role-specific loading.
-    All based on our basic policy setup in authz.policy file.
+    Static role-permission policies come from the authorization schema.
     """
 
     LIBRARY_ROLES = [
@@ -190,7 +165,7 @@ class TestPolicyLoadingStrategies(PolicyLoadingTestSetupMixin):
         super().tearDown()
 
     @ddt_data(
-        "lib^*",  # Library policies from authz.policy file
+        "lib^*",  # Library policies from the authorization schema
         "course^*",  # No course policies in basic setup
         "org^*",  # No org policies in basic setup
     )
@@ -206,7 +181,7 @@ class TestPolicyLoadingStrategies(PolicyLoadingTestSetupMixin):
             - Policy count matches expected for scope
         """
         global_enforcer = AuthzEnforcer.get_enforcer()
-        expected_policy_count = self._count_policies_in_file(scope_pattern=scope)
+        expected_policy_count = self._count_schema_policies(scope_pattern=scope)
         initial_policy_count = len(global_enforcer.get_policy())
 
         self._load_policies_for_scope(scope)
@@ -382,7 +357,7 @@ class TestPolicyLoadingStrategies(PolicyLoadingTestSetupMixin):
             - All loaded policies contain the specified role
         """
         global_enforcer = AuthzEnforcer.get_enforcer()
-        expected_count = self._count_policies_in_file(role=role_name)
+        expected_count = self._count_schema_policies(role=role_name)
 
         self._load_policies_for_role_management(role_name)
         loaded_policies = global_enforcer.get_policy()
@@ -404,8 +379,8 @@ class TestPolicyLoadingStrategies(PolicyLoadingTestSetupMixin):
         course_scope = "course-v1^*"
         org_scope = "org^*"
 
-        expected_lib_count = self._count_policies_in_file(scope_pattern=lib_scope)
-        expected_course_count = self._count_policies_in_file(scope_pattern=course_scope)
+        expected_lib_count = self._count_schema_policies(scope_pattern=lib_scope)
+        expected_course_count = self._count_schema_policies(scope_pattern=course_scope)
         self._add_test_policies_for_multiple_scopes()
         # The previous function added 6 custom policies for courses, add to expected
         expected_course_count += 6
@@ -436,7 +411,7 @@ class TestPolicyLoadingStrategies(PolicyLoadingTestSetupMixin):
         self.assertEqual(total_count, lib_count + course_count + org_count)
 
 
-class TestAutoLoadPolicy(TransactionTestCase):
+class TestAutoLoadPolicy(AuthzEnforcerTestMixin, TransactionTestCase):
     """Test cases for auto-load policy functionality.
 
     Uses TransactionTestCase to avoid database locking issues with SQLite
@@ -449,18 +424,12 @@ class TestAutoLoadPolicy(TransactionTestCase):
         AuthzEnforcer._enforcer = None  # pylint: disable=protected-access
 
     def _seed_database_with_policies(self):
-        """Seed the database with policies from the policy file."""
+        """Seed the database with policies from the authorization schema."""
         global_enforcer = AuthzEnforcer.get_enforcer()
-        global_enforcer.clear_policy()
-
-        migrate_policy_between_enforcers(
-            source_enforcer=casbin.Enforcer(
-                MODEL_CONF_PATH,
-                AUTHZ_POLICY_PATH,
-            ),
-            target_enforcer=global_enforcer,
-        )
-        global_enforcer.clear_policy()
+        with self.pause_authz_auto_load(global_enforcer):
+            global_enforcer.clear_policy()
+            seed_static_authorization_policies(global_enforcer)
+            global_enforcer.clear_policy()
 
     def _wait_for_auto_load(self) -> None:
         """Wait for one auto-load cycle plus a small buffer.