Skip to content

As a separate service

As a separate service Your app to Policy service: may ana PUT /articles/7? Policy service to Your app: allow. Other service to Policy service: may ana refund order 9? Policy service to Other service: deny. Other service: down: refuse, never allow. One policy for every service, asked over the network. Your app Other service Policy service may ana PUT /articles/7? allow may ana refund order 9? deny down: refuse, never allow One policy for every service, asked over the network
What it's for: one policy decision point that every service asks over the network, deployed and audited in one place.

A policy decision point that runs apart from the app, which every service asks over the network: Open Policy Agent, OpenFGA, SpiceDB, Cerbos. The policies are deployed and audited in one place, for every service at once.

The guide tells what changes from an engine in the process: the latency of each check, a 503 when the service doesn't answer, and an enforcer that awaits the answer.

  • Open Policy Agent: a shop whose orders and refunds a Rego policy decides, by the user's roles and the order's total, and which refuses everything while OPA is down.

Without a network, the engines in the process: Casbin and Cedar.