Open Policy Agent alongside relationship rules

Role checks are enough until access depends on attributes or on relationships between objects. Authdog authorization services can now evaluate Open Policy Agent policies as well as relationship-based access rules, so the same control plane covers both styles.

This is the longer note behind the June 27 changelog entry.

How it works

The authorization engine gained policy-backed evaluation. Policies are written in Rego, the Open Policy Agent language, and decided through the authorization API and service — not by shipping a separate OPA sidecar for every app.

That evaluation stays integrated with the models you already pick per environment:

• ABAC — attribute policies in Rego, evaluated in-process
• FGA — Zanzibar-style relationship tuples and check queries
• RBAC — roles and permissions, still the default

Each environment still runs one model. "Alongside" means the service can evaluate OPA policies or relationship rules, not that a single request mixes both engines. The comparison is in Authorization.

Set it up

In the Authdog console:

1. Open the environment and set the permission model to ABAC for Rego policies, or FGA for relationship rules.
2. Author the policy or the relationship model in Authorization.
3. Save, then call the authorization decision path your service already uses.

Prototype the richer model in a non-production environment first. Switching the model is an environment-wide change.

Trust boundaries

Authorization decides allow or deny after authentication. A policy or tuple does not issue a session. Decisions fail closed on evaluation errors. Tenant owners keep management access regardless of the end-user policy.

Do not treat a playground or staging allow as a production grant unless that environment holds the live policies or tuples.

Try it

Read Authorization and pick ABAC or FGA for one environment. The original release note is in the changelog.