Application Code of Conduct - Full-Stack Policy as Code
summary
Argues that authorization must be moved from ad-hoc middleware into a full-stack, policy-as-code system that separates enforcement, decision, retrieval, information and administration, and shows an open-source stack: Rego/Open Policy Agent, AWS Cedar, Google Zanzibar/OpenFGA, a Git-backed admin layer and a Cedar agent sidecar. Demonstrates integrating with front-end via CASL, running policy engines as containers for low-latency decisions (claiming sub-10ms), an open-source admin layer and policy-as-code workflows, plus a commercial auto-generator for policy code.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:51The Auth Comfort Zone
- 11:16ABAC - Attribute Based Access Control
- 12:08ReBAC - Relationship Based Access Control
- 18:27Open Policy Agent
- 24:30The Policy System Building Blocks
related talks
45mThe Future of Authorization in Applications
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
30mRedefining Access Control: Scaling Policy as Code for Humans and AI Agents
49mLove, Hate, And Policy Languages
42mBeyond Code: Shaping Security in a Developer-Driven World
29mAuthz as a dev workflow
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
38mPolicy as Code with Open Policy Agent