Description
Currently, all authorization policies are printed to the console during startup and/or reload. This creates noisy logs, increases log volume, and may expose sensitive authorization data in production environments.
Policy logging is useful for debugging, but it should not be enabled by default in production. Instead, it should be controlled via a configuration flag (if possible cause this is casbin's doing)
Proposed approach
Add a configuration flag to control policy logging, for example:
Behavior:
- False (default): Do not log policies.
- True: Log policies (debug mode).
Optional improvement:
- Log a summary instead (e.g., number of policies loaded).
- Move full policy logging to DEBUG level only.