WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Oct 12, 2020

Decoupled Authorization using Policy as Code

Anderson Dadario , Denys Vitali

Still hardcoding authorization logic into your software? Discover how Open Policy Agent decouples access control, letting you update permissions dynamically without ever recompiling your apps.

Pause
Mute Enter Fullscreen
#1 about 1 min

Evaluating common authentication and custom authorization challenges

While standardized authentication methods exist, custom authorization integrations often lack unified tooling and create isolated administrative silos.

#2 about 2 min

Embedding authorization logic inside application source code

Checking user roles directly within application files tightly couples core business logic to restrictive security rules.

#3 about 2 min

Decoupling business logic with policy as code

Centralizing authorization decisions allows developers to version, test, and seamlessly share governance rules across multiple distinct applications.

#4 about 3 min

Understanding XACML components for access control evaluation

Policy enforcement and decision points coordinate closely to read data sources and accurately evaluate resource access requests.

#5 about 3 min

Replacing verbose XACML with Open Policy Agent

Open Policy Agent provides a streamlined administrative alternative to complex XML-based policies using the declarative language Rego.

#6 about 2 min

Implementing Open Policy Agent in application architectures

Client applications easily interact with Open Policy Agent via REST APIs to quickly invoke decoupled external authorization decisions.

#7 about 2 min

Defining and evaluating access policies using Rego

Writing structured policy files validates complex user roles against requested runtime operations to trigger appropriate systemic violations.

#8 about 3 min

Testing and querying Rego policies via HTTP

Executing local unit tests validates operational logic before safely passing active sample inputs to the policy server.

#9 about 3 min

Integrating OPA middleware in Golang web applications

Custom server middleware cleverly intercepts incoming HTTP requests to decode authentication details and seamlessly query external authorization rules.

#10 about 3 min

Structuring hierarchical employee access rules in Rego

Defining highly specific pattern matching constraints limits system data access strictly to users or their managing network supervisors.

#11 about 3 min

Uploading and evaluating Open Policy Agent rules dynamically

Submitting raw Rego files directly via HTTP permits the immediate application of new access policies against active workflows.

#12 about 3 min

Enforcing business requirement changes without application restarts

Modifying and rapidly reloading targeted policy variables instantly updates infrastructure access logic without recompiling rigid underlying source code.

#13 about 2 min

Iterating on logic using the web-based Rego playground

The online sandbox environment offers a rapid workspace to iteratively tweak and test authorization constraints without heavy local installations.

#14 about 2 min

Expanding Open Policy Agent across diverse ecosystems

Purpose-built plugin adaptations for Kubernetes, Kafka, and Linux module integration intelligently extend policy enforcement far beyond traditional web endpoints.

#15 about 2 min

Centralizing authorization oversight and system security traceability

Standardizing access controls creates strict programmatic auditing pipelines and ultimately limits production policy modifications exclusively to authorized developers.

Matching moments

7:07 min

Implementing programmatic policy checks with Open Policy Agent

Madhu Akula · LIVE

2:36 min

Core concepts and architecture of Open Policy Agent

Philipp Krenn · WWC 2023

3:15 min

Optimizing performance and overcoming Open Policy Agent barriers

Philipp Krenn · WWC 2023

2:41 min

Usability and syntax challenges with rego and opa

Chris Nesbitt-Smith · LIVE

3:15 min

Writing basic access and resource policies in Rego

Philipp Krenn · WWC 2023

3:22 min

Testing and debugging rules in the OPA playground

Philipp Krenn · WWC 2023

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
5 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
12 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
19 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
26 days ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail
5:55
about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier
Open session

World Congress 2026 North America

Give the Agent a Budget, Not a Token

Sachin Malhotra

MTS @Anthropic

Sachin Malhotra
Open session

World Congress 2026 North America

When Agents Became Users: Rearchitecting Identity and Permissions for AI at Scale

Dor Cohen, Yoav Gal

Dor Cohen
Yoav Gal
Open session

World Congress 2026 North America

MicroAgents: The Microservices of the Agentic Era

Ashish Shubham

Runs the show bussiness at ThoughtSpot

Ashish Shubham
Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

Related videos

OPA for the cloud natives thumbnail
26:23
WWC 2023 • almost 3 years ago

OPA for the cloud natives

Philipp Krenn

Un-complicate authorization maintenance thumbnail
1:00:00
LIVE • over 2 years ago

Un-complicate authorization maintenance

Alex Olivier

Policy as [versioned] code - you're doing it wrong thumbnail
45:57
LIVE • almost 4 years ago

Policy as [versioned] code - you're doing it wrong

Chris Nesbitt-Smith

The day the chatbot asked for sudo thumbnail
27:48
WWC Europe 2026 • about 1 month ago

The day the chatbot asked for sudo

Alex Olivier

Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue thumbnail
23:29
WWC 2025 • 12 months ago

Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue

Deepu

Keymate – Modern Authorization for Developers thumbnail
6:04
WWC 2025 • 12 months ago

Keymate – Modern Authorization for Developers

Halil Özkan

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.