Love, Hate, And Policy Languages
summary
Argues fine‑grained authorization is getting harder and shows concrete tooling: Rego / Open Policy Agent for multi‑purpose policies, Cedar (AWS verified permissions) for verifiable application rules, and OpenFGA for Zanzibar‑style relationship graphs. Presents Opal, an open‑policy administration layer that centralizes Git‑backed policies, pushes realtime updates to local clients, plugs OPA and Cedar engines, and demos a karma condition change that immediately denies an action — the demo works end‑to‑end.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:49Developer authorization problems
- 7:07Fine-grained authorization complexity
- 12:46Modern authorization problems
- 15:41Policy decisions across layers
- 17:28Policy decision patterns
- 21:02Policy access control frameworks
- 26:18Google Zanzibar and relationship access
- 31:38Rego and Open Policy Agent deep dive
- 35:11AWS Cedar for authorization
- 37:01OpenFGA and Zanzibar engines
- 39:50Fine-grained authorization implementation
- 41:36OPAL introduction
- 42:20OPAL live demo
- 48:42Summary
related talks
45mThe Future of Authorization in Applications
32mImplementing Authorization
43mApplication Code of Conduct - Full-Stack Policy as Code
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
17mOpen Policy Agent Intro
34mFine-grained Authorization in a Containerized World
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
29mIntroduction to Open Policy Agent