Ask Open Policy Agent (OPA) for an authorization decision.
Open Policy Agent (OPA) evaluates policy rules using facts supplied by the application. The application must give OPA trustworthy input and must enforce the result that comes back.
Why this lesson?
An inventory request must satisfy rules about the service identity, Hypertext Transfer Protocol (HTTP) method, and scope. The application programming interface (API) asks Open Policy Agent to evaluate those verified facts.
Learning goal and prerequisites
Prepare verified request data
The API has already validated the access token and verified the calling workload. It creates policy input from those checked facts and the requested action. It must not accept a caller’s unsupported claim about their own identity or permissions.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Authorization rules often become difficult to understand when they are scattered through many application code paths. Open Policy Agent (OPA) gives a system a separate policy engine that can evaluate rules from a consistent set of inputs.
Before asking OPA for a decision, the application gathers trusted facts about the request. Those facts might include the verified user or workload identity, Hypertext Transfer Protocol (HTTP) method, resource, tenant, and token permissions. The application passes those facts to OPA, which evaluates its policy and returns a result such as allow or deny.
This is useful because policy can be reviewed, tested, and changed without rewriting every part of the business application. The application remains the enforcement point: it must actually stop the operation when OPA says no, and it should fail safely if a required decision cannot be obtained.
OPA does not validate tokens or authenticate callers unless the surrounding system explicitly builds that work into its inputs. Bad input produces a bad decision. The application must therefore verify identity and credentials first, then give OPA facts that the caller cannot simply invent.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.