public Set<ResourceDescriptor> getAllowedPublicResources(
            ProxyContext context, Set<ResourceDescriptor> resources) {
        resources = resources.stream()
                .filter(ResourceDescriptor::isPublic)
                .collect(Collectors.toUnmodifiableSet());

        if (resources.isEmpty()) {
            return Set.of();
        }

        Map<String, List<Rule>> rules = getCachedRules();
        Map<String, Boolean> cache = new HashMap<>();
        for (ResourceDescriptor resource : resources) {
            evaluate(context, resource, rules, cache);
        }

        return resources.stream()
                .filter(resource -> {
                    resource = resource.isFolder() ? resource : resource.getParent();
                    return resource == null || cache.get(ruleUrl(resource));
                })
                .collect(Collectors.toUnmodifiableSet());
    }
Key is updated time from the metadata. Value is decoded map (folder path, list of rules).
server/src/main/java/com/epam/aidial/core/server/service/RuleService.java