WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE β€’ Oct 12, 2020

Decoupled Authorization using Policy as Code

Anderson Dadario , Denys Vitali

Still hardcoding authorization logic into your software? Discover how Open Policy Agent decouples access control, letting you update permissions dynamically without ever recompiling your apps.

Pause
Mute Enter Fullscreen
#1 about 1 min

Evaluating common authentication and custom authorization challenges

While standardized authentication methods exist, custom authorization integrations often lack unified tooling and create isolated administrative silos.

#2 about 2 min

Embedding authorization logic inside application source code

Checking user roles directly within application files tightly couples core business logic to restrictive security rules.

#3 about 2 min

Decoupling business logic with policy as code

Centralizing authorization decisions allows developers to version, test, and seamlessly share governance rules across multiple distinct applications.

#4 about 3 min

Understanding XACML components for access control evaluation

Policy enforcement and decision points coordinate closely to read data sources and accurately evaluate resource access requests.

#5 about 3 min

Replacing verbose XACML with Open Policy Agent

Open Policy Agent provides a streamlined administrative alternative to complex XML-based policies using the declarative language Rego.

#6 about 2 min

Implementing Open Policy Agent in application architectures

Client applications easily interact with Open Policy Agent via REST APIs to quickly invoke decoupled external authorization decisions.

#7 about 2 min

Defining and evaluating access policies using Rego

Writing structured policy files validates complex user roles against requested runtime operations to trigger appropriate systemic violations.

#8 about 3 min

Testing and querying Rego policies via HTTP

Executing local unit tests validates operational logic before safely passing active sample inputs to the policy server.

#9 about 3 min

Integrating OPA middleware in Golang web applications

Custom server middleware cleverly intercepts incoming HTTP requests to decode authentication details and seamlessly query external authorization rules.

#10 about 3 min

Structuring hierarchical employee access rules in Rego

Defining highly specific pattern matching constraints limits system data access strictly to users or their managing network supervisors.

#11 about 3 min

Uploading and evaluating Open Policy Agent rules dynamically

Submitting raw Rego files directly via HTTP permits the immediate application of new access policies against active workflows.

#12 about 3 min

Enforcing business requirement changes without application restarts

Modifying and rapidly reloading targeted policy variables instantly updates infrastructure access logic without recompiling rigid underlying source code.

#13 about 2 min

Iterating on logic using the web-based Rego playground

The online sandbox environment offers a rapid workspace to iteratively tweak and test authorization constraints without heavy local installations.

#14 about 2 min

Expanding Open Policy Agent across diverse ecosystems

Purpose-built plugin adaptations for Kubernetes, Kafka, and Linux module integration intelligently extend policy enforcement far beyond traditional web endpoints.

#15 about 2 min

Centralizing authorization oversight and system security traceability

Standardizing access controls creates strict programmatic auditing pipelines and ultimately limits production policy modifications exclusively to authorized developers.

Matching moments

7:07 min

Implementing programmatic policy checks with Open Policy Agent

Madhu Akula Β· LIVE

2:36 min

Core concepts and architecture of Open Policy Agent

Philipp Krenn Β· World Congress 2023

3:15 min

Optimizing performance and overcoming Open Policy Agent barriers

Philipp Krenn Β· World Congress 2023

2:41 min

Usability and syntax challenges with rego and opa

Chris Nesbitt-Smith Β· LIVE

3:15 min

Writing basic access and resource policies in Rego

Philipp Krenn Β· World Congress 2023

3:22 min

Testing and debugging rules in the OPA playground

Philipp Krenn Β· World Congress 2023

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
5 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof CieΕ›lak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
7 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
12 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
14 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
19 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail
1:04:42
19 days ago

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 Β· 11:40–12:10

Stage 6

Codifying Trade-offs: Security, Cost, and Compliance as Agent Guardrails

Suzanne Daniels

Chief Developer Advisor at Microsoft

Suzanne Daniels
Open session

World Congress 2026 North America

September 24, 2026 Β· 16:50–17:20

Stage 2

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier
Open session

World Congress 2026 North America

September 25, 2026 Β· 12:20–12:50

Stage 4

Give the Agent a Budget, Not a Token

Sachin Malhotra

MTS @Anthropic

Sachin Malhotra
Open session

World Congress 2026 North America

September 24, 2026 Β· 14:50–15:20

Stage 7

When Agents Became Users: Rearchitecting Identity and Permissions for AI at Scale

Yoav Gal

Product Lead

Yoav Gal
Open session

World Congress 2026 North America

September 23, 2026 Β· 15:45–17:45

Stage 8

Docker's Agentic Platform: Sandboxes, MCP, and the Infrastructure of Autonomous Development

Oleg Ε elajev

AI and Developer Relations at Docker

Oleg Ε elajev
Open session

World Congress 2026 North America

September 24, 2026 Β· 16:10–16:40

Stage 1

Closing the autonomous software development loop

Justin Halsall

Core Team Maintainer and CEO at rrweb

Justin Halsall

Related videos

OPA for the cloud natives thumbnail
26:23
World Congress 2023 β€’ almost 3 years ago

OPA for the cloud natives

Philipp Krenn

Un-complicate authorization maintenance thumbnail
1:00:00
LIVE β€’ over 2 years ago

Un-complicate authorization maintenance

Alex Olivier

Policy as [versioned] code - you're doing it wrong thumbnail
45:57
LIVE β€’ almost 4 years ago

Policy as [versioned] code - you're doing it wrong

Chris Nesbitt-Smith

The day the chatbot asked for sudo thumbnail
27:48
World Congress 2026 Europe β€’ 2 months ago

The day the chatbot asked for sudo

Alex Olivier

Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue thumbnail
23:29
World Congress 2025 β€’ about 1 year ago

Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue

Deepu

Keymate – Modern Authorization for Developers thumbnail
6:04
World Congress 2025 β€’ about 1 year ago

Keymate – Modern Authorization for Developers

Halil Γ–zkan

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.