Implementing Authorization
summary
Shows how Open Policy Agent and its Rego language decouple policy from application code, letting services query a central engine for allow/deny decisions instead of hardcoding rules. Demonstrates ACL, RBAC and ABAC models in one language, mentions optimized RBAC checks at around 50 microseconds for thousands of roles, and explains partial evaluation that compiles policies into SQL WHERE-like filters so data filtering runs inside the database. Mentions real integrations: Kubernetes admission control, PAM/SSH/sudo, and companies like Netflix and Chef using it.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:24Heavy lifting
- 1:19Authorization
- 2:10Authentication vs Authorization
- 5:46OAuth
- 7:41App Authorization
- 11:12Common Approaches
- 14:00Tradeoffs
- 17:38Demo
- 24:12Use Cases
related talks
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
14mA Policy-as-Code Approach to RBAC Authorization
16mDistributed application level RBAC with OPA
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
34mFine-grained Authorization in a Containerized World
39mIntro: Open Policy Agent
39mIntro: Open Policy Agent
37mMake your security policy auditable