Architecture: Policy as Code with OPA

A policy change gets approved at 4pm. It needs to reach 600 OPA instances spread across four clusters in three regions. Someone asks three questions. How long until every instance is enforcing the new rule? How do you know none of them silently kept the old one? And if an auditor asks what the system decided at 4:15pm, where exactly do you look? None of these are Rego questions. You can write a flawless policy and still fail all three. They are qu… Read More

Architecture: Zero Trust

A contractor joins for two weeks to fix a reporting dashboard. Someone in IT provisions a VPN account, the contractor connects, and the laptop picks up an address inside the corporate range. The dashboard loads. So does everything else. From that laptop the build servers answer. So does the internal wiki, the file share holding three years of payroll exports nobody archived, the printer management console, and a Jenkins instance last patched in 2… Read More