3 ms·

If authorizations can be described as a policy graph, what about logic programming languages such as Prolog or Datalog? Would Datalog be performant enough at s

by hosh 3y ago

If authorizations can be described as a policy graph, what about logic programming languages such as Prolog or Datalog? Would Datalog be performant enough at scale? I think one neat thing about logic programming languages is that you can ask for the reasoning chain to get to the conclusion it did, or do reverse queries. (Such as, give me all the actions that a person is authorized for this time)

refset 3y ago
Likely of interest: https://neilmadden.blog/2022/02/19/is-datalog-a-good-language-for-authorization/ https://neilmadden.blog/2022/02/19/is-datalog-a-good-languag... (Feb 2022 discussion: https://news.ycombinator.com/item?id=30400886 https://news.ycombinator.com/item?id=30400886)
tommiegannert 3y ago
SecPAL (~2007) was essentially Datalog for policy (the paper included a transform to Datalog.) I'd be interested to know if anyone implemented it. https://en.wikipedia.org/wiki/SecPAL https://en.wikipedia.org/wiki/SecPAL
cryptonector 3y ago
> If authorizations can be described as a policy graph, what about logic programming languages such as Prolog or Datalog? Or why not SQL? Which will be more optimized -or is easier to optimize- for the logic in question?
hirundo 3y ago
Seems like the lisps are already both as written, and any language that can be rendered as an s-expression is either.
rsstack 3y ago
That's what Oso do: https://docs.osohq.com/guides/policies.html https://docs.osohq.com/guides/policies.html
jzelinskie 3y ago
Many of the optimizations used when traversing the graph for SpiceDB are inspired by research in the various dialects of Datalog. At the end of the day, there are very few operations that authorization systems need and it makes more sense to optimized those for folks than give them direct access to Datalog or general purpose graph languages like Gremlin.
jeffchao 3y ago
That's a great observation. There's prior art in authorization (and also in the Kubernetes domain) with folks using Open Policy Agent -- specifically, Rego [0], a derivative of Datalog. I've used it with success in authorization, but the developer experience could be better. I've found the experience to be better when paired with some constraint framework. The other trade-off as mentioned in another comment is that it's stateless. The pro is that it's stateless, but the con is that someone needs to figure out a way to get input and data into your evaluation runtime so that you can write meaningful policies. [0] https://www.openpolicyagent.org/docs/latest/policy-language/ https://www.openpolicyagent.org/docs/latest/policy-language/
orweis 3y ago
That's exactly what OPA does (Datalog), and what OSO do (Prolog)

by hosh 3y ago

refset 3y ago

Likely of interest: https://neilmadden.blog/2022/02/19/is-datalog-a-good-language-for-authorization/ https://neilmadden.blog/2022/02/19/is-datalog-a-good-languag... (Feb 2022 discussion: https://news.ycombinator.com/item?id=30400886 https://news.ycombinator.com/item?id=30400886)

tommiegannert 3y ago

SecPAL (~2007) was essentially Datalog for policy (the paper included a transform to Datalog.) I'd be interested to know if anyone implemented it. https://en.wikipedia.org/wiki/SecPAL https://en.wikipedia.org/wiki/SecPAL

cryptonector 3y ago

> If authorizations can be described as a policy graph, what about logic programming languages such as Prolog or Datalog? Or why not SQL? Which will be more optimized -or is easier to optimize- for the logic in question?

hirundo 3y ago

Seems like the lisps are already both as written, and any language that can be rendered as an s-expression is either.

rsstack 3y ago

That's what Oso do: https://docs.osohq.com/guides/policies.html https://docs.osohq.com/guides/policies.html

jzelinskie 3y ago

Many of the optimizations used when traversing the graph for SpiceDB are inspired by research in the various dialects of Datalog. At the end of the day, there are very few operations that authorization systems need and it makes more sense to optimized those for folks than give them direct access to Datalog or general purpose graph languages like Gremlin.

jeffchao 3y ago

That's a great observation. There's prior art in authorization (and also in the Kubernetes domain) with folks using Open Policy Agent -- specifically, Rego [0], a derivative of Datalog. I've used it with success in authorization, but the developer experience could be better. I've found the experience to be better when paired with some constraint framework. The other trade-off as mentioned in another comment is that it's stateless. The pro is that it's stateless, but the con is that someone needs to figure out a way to get input and data into your evaluation runtime so that you can write meaningful policies. [0] https://www.openpolicyagent.org/docs/latest/policy-language/ https://www.openpolicyagent.org/docs/latest/policy-language/

orweis 3y ago

That's exactly what OPA does (Datalog), and what OSO do (Prolog)