2 ms·
I've used OPA [1] before, which is very similar. The whole point is to have language agnostic policy definitions. You write policies in the custom policy lang
by the_duke 6y ago
I've used OPA [1] before, which is very similar.
The whole point is to have language agnostic policy definitions. You write policies in the custom policy language, and every application that needs to do permission checks goes through the provided policy engine.
The programming language specific code just is some plumbing for accessing the policy agent.
So policies are inherently shareable.
[1] https://www.openpolicyagent.org/ https://www.openpolicyagent.org/
- samjs 6y ago(oso CTO, somewhat biased) > The programming language specific code just is some plumbing for accessing the policy agent. If you want to make policy decisions over your application data you still need to work out a way to move it into the OPA service, or send it as part of the policy request. You can make oso policies language agnostic if you take a similar approach and have a small number of shim rules that handle the application-specific parts.
- samjs 6y agoI will say though: OPA is an awesome project and we drew a bunch of inspiration from it early on. I'm excited about more people being aware of the power of declarative policy as code :)