Decoupled Authorization using Policy as Code

What if you could change authorization rules without redeploying your application? See how to manage access control like code.

#1about 3 minutes

The challenges of embedding authorization in application code

Embedding authorization logic directly into application code leads to tight coupling, auditing difficulties, and operational overhead when policies change.

#2about 6 minutes

Introducing Policy as Code and Open Policy Agent

Policy as Code decouples authorization from business logic, and Open Policy Agent (OPA) is an open-source engine that implements this pattern.

#3about 3 minutes

How OPA works with a simple Rego policy

A simple example demonstrates how an application delegates authorization decisions to OPA by sending a JSON input to be evaluated against a policy written in Rego.

#4about 2 minutes

Demo of basic policy evaluation using OPA

A command-line demo shows how to run OPA tests, start the server, and use curl to query the policy engine with different inputs to get allow or deny decisions.

#5about 7 minutes

Demo of integrating OPA with a Go API middleware

A Go web service uses a middleware to intercept requests, construct an input object, and query OPA to enforce complex, attribute-based access control rules.

#6about 4 minutes

Dynamically updating authorization policies without downtime

By updating a policy file and reloading it into the running OPA server via an API call, authorization rules can be changed instantly without restarting the application.

#7about 3 minutes