Policy-as-Code (OPAL)
Managing authorization policies as version-controlled code artifacts rather than database records. Enables GitOps workflows: PR → review → merge → policy update via real-time sync (OPAL).
Policy-as-Code is the practice of managing authorization policies as version-controlled code artifacts — stored in Git, reviewed via pull requests, and deployed through CI/CD pipelines. This brings software engineering best practices to authorization: version history, peer review, automated testing, and rollback.
OPAL (Open Policy Administration Layer)
OPAL is the open-source project that enables real-time policy synchronization. When a policy file is merged to your Git repository, OPAL pushes the update to all running PDP instances in real time — no restart, no cache expiration, no polling.
Policy-as-code vs policy-as-data
Policy-as-code (OPA/Rego, Cedar) expresses rules in a domain-specific language. Policy-as-data (WardenAuth) expresses rules as structured JSON — roles, permissions, conditions — managed through a dashboard or API. Policy-as-code gives you GitOps; policy-as-data gives you accessibility for non-engineers.
Related terms
The authorization engine that evaluates access requests against policies and returns allow/deny decisions. The PDP is the "brain" — it owns the rules and logic.
CNCF-graduated policy engine that evaluates policies written in Rego. Used for authorization across Kubernetes, microservices, and APIs. Requires learning a domain-specific language.
Architecture pattern where authorization logic is moved from application code to a dedicated service (PDP). Your app asks for decisions rather than embedding permission checks.