Can It Be Done? Building Fine-Grained Access Control for Back...
summary
Shows a working Backstage permissions backend that swaps TypeScript checks for Rego policies, querying a local sidecar OPA binary ~30MB to make decisions and return allow/deny. Policies update on the fly so permission changes don’t require redeploys; demo edits take effect immediately. Notes implementation gotchas: Backstage doesn’t supply resource IDs so it relies on partial/conditional evaluation, which improves scale but limits centralized audit logging unless extra work is added.
AI-written summary · about
chapters (9)
- 0:00Fine-grained access control intro
- 3:30What is policy and policy as code
- 8:54Why use OPA
- 13:32Motivation for OPA + Backstage
- 16:25Backstage permissions overview
- 17:28Integrating OPA with permissions
- 19:43Live demo: OPA in Backstage
- 21:49OPA benefits and future in Backstage
- 23:12Q&A on policy reuse and performance
related talks
21mSecuring Backstage Plugins Using the Permissions Framework
16mDistributed application level RBAC with OPA
20mBuilding Scalable Access Control Frameworks in React
25mMake Your Security Policy Auditable
19mCentralized Compliance: Automated Governance Inside of Backstage...
32mImplementing Authorization
37mMake your security policy auditable
47mFine Grained Authorisation with Relationship Based Access Control