Intermediate LevelAuthentication & Authorization
What is Open Policy Agent (OPA) and how does it decouple authorization policy from application code?
❓ Interview Prompt: Explain Open Policy Agent (OPA), Rego policy language, policy sidecars, and decoupled authorization decisions.
Embedding complex 'if/else' permission logic directly inside application code leads to policy fragmentation and auditing challenges. Open Policy Agent (OPA) decouples authorization policy from application logic.
How OPA Works:
1
Rego Language: Policies are written in Rego, a declarative policy language.
2
Policy Sidecar Execution: OPA runs as a lightweight sidecar container alongside applications.
3
Query/Decision Loop: The application queries OPA over HTTP/gRPC passing JSON context ('{ user, action, resource }'). OPA evaluates policies and returns a structured boolean decision ('{ "allow": true }').
Code Implementation Example
ruby
# Rego policy defining document authorization rules
package app.authz
default allow = false
# Allow access if user is admin OR user is document owner during business hours
allow {
input.user.role == "admin"
}
allow {
input.user.id == input.resource.owner_id
input.action == "read"
}💡Rego policy defining authorization rules evaluated by Open Policy Agent.
🎯 Interview Key Takeaway
Open Policy Agent (OPA) evaluates Rego policies in sidecar microservices, decoupling authorization logic from application code.
#OPA#Rego#Authorization#Policy Engine#Intermediate
Back to all Authentication & Authorization Questions→