Architecture: Policy as Code with OPA

A policy change gets approved at 4pm. It needs to reach 600 OPA instances spread across four clusters in three regions. Someone asks three questions. How long until every instance is enforcing the new rule? How do you know none of them silently kept the old one? And if an auditor asks what the system decided at 4:15pm, where exactly do you look? None of these are Rego questions. You can write a flawless policy and still fail all three. They are qu… Read More

Explained: Open Policy Agent

A new engineer asks who is allowed to delete an invoice. You say you will find out, which is the first sign of trouble. The answer lives in four places. There is a role check in the API gateway config. There is an if user.role == "admin" in the invoices service. There is a slightly different check in the nightly cleanup job, written a year later by someone who did not know about the first two. And there is a comment in the billing servi… Read More