Resource hub · Platform and DevOps
Policy as code and authorization operations for platform teams
Platform teams end up owning authorization whether they planned to or not. Someone has to run the decision points, keep policy and data in sync across services, and make sure a policy change goes through review like any other change.
These resources cover the operational side: how policy as code works, how OPAL keeps engines up to date, and how to deploy Permit in the cloud, hybrid or fully inside your own network.
Problems this page helps with
- Keeping policy and permission data in sync across many services
- Running decision points with low latency close to the app
- Reviewing, testing and promoting policy changes like code
The short version
Run decision points close to each service, keep policy and data in sync with OPAL, and ship policy changes through the same review and CI/CD as code.
Key concepts
Policy as code
Policy lives in Git, gets reviewed in pull requests and is promoted across environments like any other change.
PDP
The policy decision point. A container that answers permission checks next to the service that asks.
OPAL
Open source sync layer that pushes policy and data updates to every PDP in real time.
Hybrid deployment
Manage policy in the cloud while decisions and data stay inside your own network.
How policy reaches every service
- 1
Git and CI/CD
policy reviewed and versioned
- 2
Control plane
policy, roles and tenants
- 3
OPAL
streams policy and data updates
- 4
PDP per service
local decisions, low latency
Running authorization at scale
Central service over the network
- Every check adds a network hop
- Outage in one service blocks all decisions
- Policy changes need coordinated deploys
Local PDPs synced by OPAL
- Decisions next to the enforcement point
- Services keep deciding if the control plane is unreachable
- Policy changes roll out through Git and CI/CD
How Permit handles it
- P99 RBAC check (Nexus PDP beta)
- 5.6 ms
- P99 three-hop ReBAC check
- <11.3 ms
- checks per 2 CPU pod
- 658/s
- 01
Deploy where you need it
As shared in our docs, PDPs run as containers in your cloud, on Kubernetes or fully on-prem.
- 02
Policy as code and as graph
Permit combines policy as code with policy as graph, so ReBAC relationships and attribute rules live in one model.
- 03
Nexus PDP
Nexus PDP deploys next to the enforcement point for near-zero network latency. Its beta build reports 5.6 ms P99 for RBAC and under 11.3 ms P99 for three-hop ReBAC checks.
- 04
Infrastructure as code
Manage resources, roles and policies with the Terraform provider and GitOps.
“If security slows down the application, developers will be tempted to skip security measures altogether—which is an even bigger risk. That’s why having a local PDP is extremely important for us.”
Go deeper
Policy as code
- BlogWhat is policy as code?The practice of defining and enforcing policy in code, its benefits and the main tools.
- BlogEveryone loves policy as code, no one wants to write RegoHow to keep the benefits of policy as code without making every engineer learn a policy language.
- DocsGitOps for policyStore and version policy in your own Git repository.
- DocsCI/CD for policyTest and promote policy changes across environments in your pipeline.
OPAL and the decision architecture
- BlogIntroduction to OPALThe open source administration layer that keeps OPA and Cedar agents up to date in real time.
- BlogPEP, PDP and decision logsEnforce in the app, decide in a local PDP synced by OPAL, and keep the decision log.
- BlogHow Reddit scaled to millions of decisions per secondHow Reddit built and scaled its own authorization service, and what that teaches about running decisions at volume.
- ProductPermit open sourceOPAL and the other open source projects behind Permit.
Deploy and operate
- DocsPolicy decision pointsHow PDPs work and how to run them next to your services.
- BlogDeploying fine-grained authorization on-premRunning Permit inside your VPC on Kubernetes or in a hybrid setup.
- DocsTerraform providerManage resources, roles and policies as infrastructure.
- BlogMulti-tenant Postgres permissionsEnforcing tenant isolation down at the data layer.