However, this means anytime a workload changes (often), we need to update the policy.

Instead, the opposite was chosen: each workload will list the policies that select it.
This works out to be more efficient in common cases where policies change much less often than workloads.
This only applies for selector-based policies; namespaced and global policies can be handled without needing to list them out in the Workload API.

      761179012939631437L,
      1263739024124850375L
    },
    {Long.MAX_VALUE, 2, 325, 9375, 28178, 450775, 9780504, 1795265022}
  };

  private enum MillerRabinTester {
    /** Works for inputs ≤ FLOOR_SQRT_MAX_LONG. */
    SMALL {
      @Override
      long mulMod(long a, long b, long m) {
        /*

export MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN='dc=minioad,dc=local;dc=somedomain,dc=com'
export MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER='(&(objectclass=groupOfNames)(member=%d))'
minio server ~/test
```

You can make sure it works appropriately using our [example program](https://raw.githubusercontent.com/minio/minio/master/docs/sts/ldap.go):

```
$ go run ldap.go -u foouser -p foopassword

##### Credentials
{

   *   <li>idempotence: {@code a.canonical(domain).canonical(domain).equals(a.canonical(domain))}
   * </ul>
   *
   * <p>Furthermore, this method guarantees that the range returned will be one of the following
   * canonical forms:
   *
   * <ul>
   *   <li>[start..end)
   *   <li>[start..+∞)
   *   <li>(-∞..end) (only if type {@code C} is unbounded below)
   *   <li>(-∞..+∞) (only if type {@code C} is unbounded below)
   * </ul>

    if (part.length() < 1 || part.length() > MAX_DOMAIN_PART_LENGTH) {
      return false;
    }

    /*
     * GWT claims to support java.lang.Character's char-classification methods, but it actually only
     * works for ASCII. So for now, assume any non-ASCII characters are valid. The only place this
     * seems to be documented is here:
     * https://groups.google.com/d/topic/google-web-toolkit-contributors/1UEzsryq1XI
     *

 *
 * ### Percent encoding
 *
 * Percent encoding replaces a character (like `\ud83c\udf69`) with its UTF-8 hex bytes (like
 * `%F0%9F%8D%A9`). This approach works for whitespace characters, control characters, non-ASCII
 * characters, and characters that already have another meaning in a particular context.
 *

    @Override
    public SortedMap<K, V> tailMap(K fromKey) {
      return tailMap(fromKey, true);
    }

    private static final long serialVersionUID = 0;
  }

  @GwtIncompatible // works but is needed only for NavigableMap
  @CheckForNull
  private static <K extends @Nullable Object, V extends @Nullable Object>
      Map.Entry<K, V> nullableSynchronizedEntry(

      761179012939631437L,
      1263739024124850375L
    },
    {Long.MAX_VALUE, 2, 325, 9375, 28178, 450775, 9780504, 1795265022}
  };

  private enum MillerRabinTester {
    /** Works for inputs ≤ FLOOR_SQRT_MAX_LONG. */
    SMALL {
      @Override
      long mulMod(long a, long b, long m) {
        /*

    @Override
    public SortedMap<K, V> tailMap(K fromKey) {
      return tailMap(fromKey, true);
    }

    private static final long serialVersionUID = 0;
  }

  @GwtIncompatible // works but is needed only for NavigableMap
  @CheckForNull
  private static <K extends @Nullable Object, V extends @Nullable Object>
      Map.Entry<K, V> nullableSynchronizedEntry(

  // description talks about `keys`, `values`, and `entries`; here the `keys` and `values` arrays
  // are replaced by a single `elements` array but everything else works similarly.

  /**
   * The hashtable object. This can be either:
   *
   * <ul>
   *   <li>a byte[], short[], or int[], with size a power of two, created by