Make your security policy auditable
summary
Claims an auditable authorization layer by extracting rules from app code into Open Policy Agent and authoring them as Rego policies, migrates a Spring Boot example step‑by‑step to call OPA for salary checks, and pushes static hierarchy data to OPA via a web bundle served from an API (api6). Demo shows authorization working end‑to‑end after streaming data, but the bundle-sync job is missing so a transient mismatch breaks demo runs. Notes tradeoffs: single-language auditability vs Rego unfamiliarity and added API-call latency.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 1:51Security policy challenges today
- 4:22Risk management in security
- 9:26Current Spring Security demo
- 12:44Problems with compiled policies
- 16:04Policy as code with OPA
- 21:15OPA integration demo
- 23:45Moving auth to API gateway
- 28:04Why audits need better tools
- 30:55Q&A session
related talks
25mMake Your Security Policy Auditable
25mThe right feature at the right place: the example of authorization
32mOPA: So What Does the Policy Do?
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
29mOpen Policy Agent (OPA) Intro & Deep Dive
32mImplementing Authorization