Episode 18 of The Security Podcast of Silicon Valley aired on July 3, 2022, with Jon McLachlan hosting. The guest was Anders Eknert, developer advocate at Styra, the company behind the Open Policy Agent (Podbean, Apple Podcasts, Spotify). The episode is called “Anders Eknert, Developer Advocate at Styra, On Evolved Authorization.” On the tape, Anders says KubeCon is in Spain again that year, and that Styra is hiring a developer advocate.
Anders described OPA in a few words. You give it a policy, and then:
“you ask it questions and it gives you back answers.”
Anders Eknert, at 0:39
That makes it an oracle, he said.
This page follows the conversation in order: a section for each part of it, sixteen figures, thirteen clips from the tape, two LinkedIn posts, two talks on YouTube, the full transcript, and five tools: a quiz, a scorecard for whether your authorization decides in one place, a calculator for what scattered authorization costs, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.
An oracle for policy
Jon opened by asking what Styra is and what open source project stands behind it. Anders said Styra founded the Open Policy Agent, or OPA:
“an open source, general purpose policy engine.”
Anders Eknert, at 0:33
The answers are decisions, and the questions can come from users, services or other clients. Anders gave three kinds of question a policy commonly decides. Can this piece of infrastructure be deployed to this environment? Can this Kubernetes resource be deployed to this cluster? And:
“whether a user should be allowed to do action X or Y in some environment or in some system”
Anders Eknert, at 1:04
The decision rests on the data in the input, which is often the resource itself. It can be any data, Anders said, like the time of day or the weather outside.
The OPA docs describe the project the same way today. OPA is a general-purpose policy engine that “unifies policy enforcement across the stack.” It gives you a declarative language for policy as code, and APIs to “offload policy decision-making from your software” (OPA). Wikipedia files OPA under a term from the XACML standard. It calls OPA “an open-source Policy Decision Point (PDP) implementation” that can be used wherever a policy decision is required (Wikipedia).
OPA at Pure Storage
Jon added that OPA is entirely open source. You can deploy the whole stack yourself, and a developer community drives it forward. That gives you the advantage of a full-time developer team without the overhead, he said, and:
“everyone there is excited to do the right thing.”
Jon McLachlan, at 1:53
Then he told his own OPA story.
“I know that I’ve contributed just a little bit to OPA in a past life.”
Jon McLachlan, at 1:56
At Pure Storage, his team used OPA for access to production. The goal was:
“to help make our systems decide whether or not someone had the authentication and authorization to access specific production machines.”
Jon McLachlan, at 2:06
They wanted all of it driven by policy, and OPA fit that use case and the rest of their integration. Only after they had built it on the open source project did they notice there was a company behind it. Styra showed them a demo, a GUI, testing features and change lifecycle management. Jon left Pure Storage before that conversation ended. He remembers being impressed, and he had nothing but good things to say about the Styra engineers he worked with.
Pure Storage has a new name since the tape. Wikipedia lists the company as Everpure, after a rebrand in February 2026 (Wikipedia). OPA itself had reached a milestone before the tape. On February 4, 2021, the Cloud Native Computing Foundation announced that OPA had graduated. It had joined the CNCF sandbox in April 2018 and moved to incubation a year later. The announcement counted more than 90 contributors from about 30 organizations, and maintainers from Google, Microsoft, VMware and Styra (CNCF). The CNCF is a subsidiary of the Linux Foundation, founded in 2015 to support cloud-native computing (Wikipedia).
A different answer in every team
Anders was biased, he said, and Jon pointed out that he himself was a little less biased, with no stake in Styra. Anders’s own story started at a customer.
“my story is pretty similar.”
Anders Eknert, at 3:15
He worked at Bisnode, a big provider of data to governments, organizations and corporations. Wikipedia describes Bisnode as a company that offered decision support with business, marketing and credit information, and says Dun and Bradstreet acquired it (Wikipedia). Bisnode was looking for a way to solve authorization in a distributed environment.
“So we had about six or seven hundred services”
Anders Eknert, at 3:38
Before, each team had come up with its own way to solve authorization. Some ways were better than others, Anders said, but they were all different. That made it hard to work together across team boundaries. Worse, it made auditing all but impossible. Some teams logged their authorization decisions and some didn’t, and the ones that did logged them in their own formats, mixed in with their other logs.
“there wasn’t a way to audit”
Anders Eknert, at 4:28
For Bisnode, an audit trail was a hard requirement.
Found at KubeCon
That summer, the team traveled to KubeCon in Spain. Anders said KubeCon happened to be in Spain again that year. The trip wasn’t meant to find an authorization engine, but that’s how it turned out: they came across OPA there. Back home they built a small proof of concept and put authorization in front of a few microservices, and the rest followed.
“We can use this for infrastructure. We could use this for so much more.”
Anders Eknert, at 5:09
Kubernetes came next. Wikipedia describes Kubernetes as an open-source container orchestration system for deploying, scaling and managing software, and lists OPA among the CNCF projects that extend it (Wikipedia).
After a while, Bisnode had clusters of OPAs running across a large environment, and needed a way to manage them. Either they would build something, or they would find something better that already existed. That’s how Anders found Styra. Bisnode worked with Styra for a while and became a customer. Anders had so much fun that the grass looked greener on Styra’s side, he said, and he moved. His LinkedIn lists him as a developer advocate at Styra from December 2020, “Advocating Open Policy Agent (OPA) at Styra” (LinkedIn).
Jon summed it up: they had the same story, except Anders ended up working there. Anders joked that Jon didn’t, yet.
A security company?
Jon asked whether Styra is a security company or a business-to-business company for change lifecycle management, or whether those are the same thing.
Anders said he tends to think of Styra as a security company. Jon agreed. He saw it in his time with Styra’s developers in the open source project.
“It’s in your DNA.”
Jon McLachlan, at 6:41
Security had always been a passion for Jon, he said, and he asked how Anders got into it.
From identity to authorization
Anders worked at Bisnode twice. The first time, he was on a team whose main job was:
“to provide an identity solution for the company.”
Anders Eknert, at 7:09
That got him into the standards around identity: OAuth, OpenID Connect, and SCIM for user provisioning. Wikipedia describes OAuth as “an open standard for access delegation.” OpenID Connect, published by the OpenID Foundation in February 2014, lets clients receive information about authenticated sessions and end users. SCIM is a standard for exchanging user identity information between identity domains or IT systems.
Then he moved to a vendor in the identity space, Curity, a name with a joke in it. Curity is heavy on Java, Anders explained, and Java package names spell a domain backwards. Sweden’s country code is SE, so the package is se.curity. Jon spelled the name out for listeners. Anders’s LinkedIn lists him as a tech lead at Curity from October 2016 to August 2018, working with open standards “such as OAuth2, OpenID Connect and SCIM” (LinkedIn).
He spent almost two years there learning the ropes of identity. And he noticed something about identity companies:
“they’re very strictly scoped to identity.”
Anders Eknert, at 8:32
Customers would come back with a token, a JSON web token or something else that proves identity, and ask what to do with it. That question, Anders said, is obviously authorization. The vendor’s answer was that it wasn’t their problem. In Anders’s words, everyone said:
“nah, that’s really not our concern.”
Anders Eknert, at 8:52
“Eventually I got curious, like, what if it was my concern?”
Anders Eknert, at 8:56
What do people do with these tokens? How do you solve the authorization problem? Those questions led him to Styra. A JSON Web Token is a proposed Internet standard for data whose JSON payload “asserts some number of claims” (Wikipedia). It says who you are. It doesn’t say what you may do.
Two questions
Jon put the two problems side by side.
“The authentication problem, I always think of that as the answer to the question, who are you?”
Jon McLachlan, at 9:16
The answer usually goes back to a person, he said, but it can be a service, a device, an instance in the cloud or a node on Kubernetes. The other problem is authorization, authZ for short, and he asked Anders what that one is. Anders started with identity:
“identity, again, it’s pretty strictly scoped, but it’s also very well defined.”
Anders Eknert, at 9:59
Identity has standards at your disposal. Authorization, for a long time, had none, he said, and:
“none of these big vendors in the security space have really cared for that until a few years ago.”
Anders Eknert, at 10:18
“it’s been like the Wild West, pretty much”
Anders Eknert, at 10:26
In identity, everything is well defined and nobody deviates from the standards. That has a cost too, Anders said:
“it’s great to work with standards, but they’re also limiting in terms of creativity”
Anders Eknert, at 10:41
Wikipedia draws the same line. Authentication is “the act of proving an assertion, such as the identity of a computer system user.” Authorization is specifying rights to resources, usually through an access policy, and then deciding whether a subject may access a resource. Authorization did have a standard before OPA. OASIS ratified XACML 1.0, an XML-based language for access control policies, in 2003 (Wikipedia).
Policy follows the business
Jon took the second question.
“because authZ is the answer to the question, what can you do?”
Jon McLachlan, at 10:47
“I often find that those are business-driven.”
Jon McLachlan, at 10:51
That’s why he thinks OPA is powerful. You keep your own internal definition of what a policy is, and you can:
“throw it into GitHub, and now you have your change management under control for your policies.”
Jon McLachlan, at 11:03
You can go back in time and see what decisions were made for which groups of people, or for one person if you need to. It’s all just a policy, and the policy says whether you’re allowed to do something, the oracle from the start of the episode.
Anders added a contrast. Your identity hardly changes when you move between organizations: who you are, maybe your position and some roles. Authorization has no such rules. Each organization decides, or whoever designs its authorization system, so it’s far more flexible. It’s also:
“way easier to do it wrong as well, because there aren’t really these guidelines for how to do it.”
Anders Eknert, at 12:03
OPA doesn’t try to stop that, he said. It lets your policies reflect the needs of your organization or your team, good or bad:
“there’s certainly room for mistakes compared to having a strict standard to follow.”
Anders Eknert, at 12:29
Ray-go, and a word for steering
OPA’s policy language is called Rego, Anders said, and Jon realized he had been saying it wrong. Anders had made the same mistake until someone corrected him. The OPA docs give both pronunciations: OPA is “oh-pa,” and Rego is “ray-go” (OPA).
Jon asked whether Rego is a Swedish word. It isn’t, Anders said, but Styra is. In Swedish, the word means:
“pretty much steering, or to govern”
Anders Eknert, at 13:22
Jon called the name appropriate. Rego, he added, was the reason his team picked OPA at Pure Storage: the flexibility comes from the language. Wikipedia describes Rego as “a JSON-based, Turing-incomplete language based on Datalog” (Wikipedia). Datalog is a declarative logic programming language.
Rules, data and a decision
Rego is designed to model policy the way people talk about it in the real world, Anders said: as a set of rules. You write the rules, you add the data you have, like organizational rules, and:
“then you query OPA for decisions based on these rules.”
Anders Eknert, at 14:05
His example was a doctor who wants to read a patient’s medical records. Should that be allowed? OPA provides the decision, and stops there. It doesn’t enforce anything.
“It just tells you, this is my decision, and now you do what you want with that.”
Anders Eknert, at 14:28
How you enforce the decision depends on the context, he said, and that split of responsibilities is the point.
Decide in one place
Jon liked that split for a reason he applies to all engineering.
“Any systems that can be separate should be separate.”
Jon McLachlan, at 14:51
Decide in one place, and what you do with the decision is your business: refuse to sign a token, print an error message, or display something different. The payoff of centralizing:
“you get consistent decisions across your entire ecosystem.”
Jon McLachlan, at 15:18
That’s hard to get with 50 or more engineers, Jon said, everyone heads down on deadlines and contributing to the same software.
“you don’t want 50 different types of decisions being made in 50 different types of ways”
Jon McLachlan, at 15:38
You want one tool that helps everyone make the decisions their business logic needs, and corrals everyone in.
The XACML standard names the same split. Each environment has a Policy Enforcement Point, which demands authorization and grants or denies access, and a central Policy Decision Point makes the final access decision (Wikipedia). In software design, the general idea is separation of concerns: divide a complex problem into distinct concerns you can address on their own.
Policy on its own release cycle
Anders added one more separation. OPA decouples the policies from the applications, so they get their own lifecycle. You break the policy out of your application and move it elsewhere, and then you can deploy changes to policy:
“without having to recompile or redeploy your applications.”
Anders Eknert, at 16:27
That matters when you have hundreds or thousands of services, he said. It had been a pain point for him back when he worked on integrating authorization. Jon had felt the same pain.
Meeting the team
Jon asked about the best day of Anders’s time at Styra. That was an easy one, Anders said: a recent kickoff event in California. More than the trip, it was the people.
“it was the first time meeting all colleagues.”
Anders Eknert, at 17:23
He had started around the time COVID broke out and spent two years working from home. The kickoff was his first time meeting the people he’d been working with all along, and the ones who had joined since.
Bad weeks
There was no single worst day, Anders said. His job as a developer advocate is a creative process: blogging, documentation and talks. Like any creative effort, it has good days and bad days.
“And sometimes you have bad weeks”
Anders Eknert, at 18:20
In those weeks, you sit and stare at your docs and not much of value comes out, which is frustrating. Those stretches drain you, he said.
Interviews as conversations
Jon asked for a favorite interview question, and Anders said Styra was hiring a developer advocate at the time. Jon put the word out to listeners. Anders didn’t have one question. He talks with candidates about the same things Jon had asked him: a good day, a bad day, what tended to work in the past and what didn’t. Then he tries to work out whether the person would fit the team. He doesn’t believe in trying to:
“put anyone against the wall in an interview situation.”
Anders Eknert, at 19:52
He keeps the conversation as casual as he can. Hiring is hard, he said, and in the end it comes down to personality and whether the person would work in the group.
Jon agreed. He tries to melt the tension, and he hopes candidates interview him as much as he interviews them.
“Much prefer a conversation over a monologue.”
Anders Eknert, at 20:41
A conversation gives both sides better signal, Jon said. The company learns whether the person fits, and:
“it’s also really important that it’s a fit on the individual side too.”
Jon McLachlan, at 20:58
The candidate gets to make the best decision for themselves too.
Could OPA run the interview?
Helping the other side decide is what Styra does, Anders said, so they should do it in interviews too. Jon tied it back to the oracle: allowed, or not allowed.
“we’re not really at the point yet where we can have OPA doing the interviews, but who knows?”
Anders Eknert, at 21:19
Jon ran with it. Maybe someday Styra pivots into AI, and the software does the interviews and flies the airplanes. Life is a series of decisions, he said, and if you could punch in the policy you want to live by, that could be an interesting consumer product.
One app to rate everything
Then Jon asked for something forward-looking:
“what is one other tool that you see out there in the future that you wish someone would just sit down and build already?”
Jon McLachlan, at 22:05
Any space, Jon said, so Anders stepped out of security. He likes apps for rating things, but there are too many of them, each with its own problems. He has one app for restaurants, one for beers and one for wine. He wishes for one app where he could rate anything, and get his data back out to see his own history of ratings.
Jon reads reviews, because a reviewer’s comments get closer to the truth. Yelp only goes so far, he said. Anders added the grocery store: twenty of everything, and no good way to find out which one people like.
“this isn’t a hard problem. It’s just somebody just got to do it.”
Anders Eknert, at 24:23
Jon pointed out the time, energy and work it takes, and the tricky parts under the hood.
“It’s not a weekend project, that’s for sure.”
Anders Eknert, at 24:37
Maybe a few nights and weekends, Jon said, for a listener with the entrepreneurial spark.
Start with OPA
For parting words, Anders said that if you haven’t tried OPA, you should.
“There’s a pretty good resource from Styra. It’s called the Styra Academy, where you can learn the ropes and how to get started.”
Anders Eknert, at 25:15
He offered to help with any questions, since that’s his job. Today, the OPA community page links the docs, a Slack workspace, GitHub discussions and the Rego Playground (OPA). The OPA blog says the Rego Playground continues to run (OPA).
What happened after the tape
A year in review. On January 26, 2023, Anders wrote OPA’s review of 2022, its first full year as a CNCF graduated project. People met in person again, KubeCon drew thousands of attendees in Europe and North America, and the Open Policy Day with OPA ran alongside KubeCon North America. OPA and Rego added a record number of new features that year (OPA). His LinkedIn lists him as Styra’s manager of developer relations from December 2022 (LinkedIn).
OPA turns 1.0. On March 15, 2024, Anders wrote that OPA 1.0 was coming. The project’s first commit had turned eight on December 28, with more than 5,000 commits from over 400 contributors since. Great care had gone into never breaking existing policy, he wrote (OPA). OPA 1.0 shipped on December 20, 2024, “after nearly 10 years” and contributions from more than 450 developers (OPA).
On the CNCF channel. On April 15, 2025, the CNCF posted “Open Policy Agent (OPA) Intro & Deep Dive,” a session where Charlie Egan and Anders introduce the project. The OPA homepage links it as its maintainer track session (YouTube, OPA).
OPA comes to Swift. On May 14, 2025, the OPA blog introduced Swift OPA, native policy evaluation for Swift (OPA).
OPA’s creators join Apple. On August 20, 2025, the creators of OPA, along with many of Styra’s team, announced that they had joined Apple. Their note calls Apple “an enthusiastic OPA user” that runs it as part of its authorization infrastructure. Styra’s commercial distribution of OPA, called EOPA, the OPA Control Plane, Styra’s SDKs, and Regal, a linter for Rego partly written in Rego, were to move into the OPA GitHub organization. The OPA website stays with the CNCF and the community (OPA). Anders’s LinkedIn lists him at Apple from August 2025, in open source and developer relations (LinkedIn).
A decade of OPA. On October 15, 2025, Nordic APIs closed its 2025 Platform Summit with Anders’s keynote, “A Decade of Open Policy Agent” (LinkedIn). The video went up on December 1, 2025. Its notes say OPA started the movement now known as policy as code (YouTube).
Three days later, Anders shared the video. He wrote that the AI hype had him rewrite parts of the talk mid-conference, to tell a more human story: his own.
Anders on his Nordic APIs keynote going up on YouTube.
Anders Eknert · December 4, 2025
A standard for authorization. On the tape, Anders said authorization had no standards. On January 12, 2026, the OpenID Foundation approved Authorization API 1.0, from its AuthZEN Working Group, as a Final Specification (OpenID Foundation). On episode 81, Eric Olden of Strata Identity described AuthZEN as a way for enforcement points from different vendors to run the same policy, and Jon called OPA the best-kept secret in authorization.
A full house. On March 26, 2026, Anders posted about a full house at the OPA maintainer track session, with people from the OPA community and his colleagues from Apple.
Anders on a full house at the OPA maintainer track.
Anders Eknert · March 26, 2026
Policy for agent tool calls. The OPA docs now cover agent tool calling. A model doesn’t run a tool itself. It returns a structured request that names the tool and its parameters, and the harness around the model runs it. Tool calls are structured data, the docs say, which makes them “a good fit for policy based approval with OPA and Rego.” The harness is the Policy Enforcement Point, and before it runs a tool call, it asks OPA, the Policy Decision Point, for a decision. The example policy denies a list of tools, a shell among them, and denies web fetches that don’t start with https (OPA). It’s the split Jon and Anders described in 2022, with an AI agent as the system that asks.
OPA in the JVM. On November 5, 2026, the OPA blog announced that opa-java-wasm, the Java SDK for running policies compiled to Wasm, now lives in the OPA GitHub organization, with version 2.1.0 on Maven Central (OPA).
More on this site. On episode 89, Graham Neray of Oso explained why checking permissions at every level of the stack starts from fragmentation. On episode 3, Jon and Daniel Feldman took the who-are-you question to services. On episode 68, Travis McPeak of Resourcely bet on security tools that look like engineering tools. And authorization is the last layer makes the case that most companies still build authorization from scratch.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript or its section.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What did Anders compare OPA to?
a. "you ask it questions and it gives you back answers." He called it an oracle. Transcript, 0:39.
-
How many services did Bisnode have when it looked for one way to do authorization?
b. "So we had about six or seven hundred services" Transcript, 3:38.
-
Where did Anders's team come across OPA?
c. They weren't looking for an authorization engine on the trip, and found one. See Found at KubeCon.
-
Which question did Jon say authorization answers?
a. "because authZ is the answer to the question, what can you do?" Transcript, 10:47.
-
What does OPA do with a decision?
b. "It just tells you, this is my decision, and now you do what you want with that." Transcript, 14:28.
-
What does Styra mean in Swedish?
c. Steering, to govern, to steer. See Ray-go, and a word for steering.
-
What did Anders wish someone would build?
a. One app for restaurants, beers, wine and everything else, with his data out. See One app to rate everything.
Does your authorization decide in one place?
Eight questions on whether your authorization works like Bisnode’s six or seven hundred services before OPA, or like one place to ask. Each tip links the section behind it.
Scorecard · eight questions
Does your authorization decide in one place?
Answer for your company as it runs today. If two answers fit, pick the lower one.
-
Do your services ask one place for authorization decisions?
- Each team writes its own checks
- Some services share a library or an engine
- Every service asks one policy decision point
Bisnode's teams each had their own way. See A different answer in every team.
-
Can you audit every authorization decision?
- Decisions aren't logged
- Some services log them, each in its own format
- Every decision is logged in one format, with its input and result
"there wasn't a way to audit" See A different answer in every team.
-
Are your policies in version control, with review and history?
- The rules live in application code
- In a repository, without review
- In a repository, reviewed, with history you can go back through
Jon's case for policy in GitHub. See Policy follows the business.
-
Can you change a policy without redeploying the applications?
- No, the rules are compiled in
- For some services
- Yes, policy ships on its own lifecycle
"without having to recompile or redeploy your applications." See Policy on its own release cycle.
-
Do your policies have tests that run before they ship?
- No tests
- A few
- Every policy, in the pipeline
There's room for mistakes without a strict standard. See Policy follows the business.
-
Does one approach to policy cover your apps, infrastructure and Kubernetes?
- Each has its own
- Two of the three
- All three
Bisnode went from microservices to Kubernetes and infrastructure. See Found at KubeCon.
-
Do your AI agents' tool calls get a policy decision before they run?
- Agents call tools with no check
- An allowlist in the agent's code
- The harness asks a policy decision point before each call, and logs the answer
The OPA docs now cover agent tool calls. See What happened after the tape.
-
Do decisions use more than who the user is?
- Identity only
- Identity and roles
- Roles, attributes of the resource, and context such as time
A decision can rest on any data, even the time of day. See An oracle for policy.
Authorization lives in each service, and an audit has little to read. Start by listing where decisions get made, then log every decision in one format.
Some decisions come from one place, and some don't. Next, move policy into version control with tests, and give it its own release cycle.
Your services ask one decision point, and you can show what it decided. Keep the tests current, and put agent tool calls behind the same check.
What does scattered authorization cost?
When every service carries its own authorization rules, every rule change means changing, testing and redeploying each service it touches. This calculator counts that engineering time.
Calculator
What does scattered authorization cost?
Four numbers: the services a typical rule change touches, the rule changes in a year, the hours to change, test and redeploy one service, and what an engineering hour costs you.
Rolling out rule changes one service at a time takes 1,440 h of engineering a year, or 36.0 engineer-weeks, at a cost of $144,000.
The calculator counts engineering time only. It leaves out audit work, outages from inconsistent rules, and the cost of running a policy engine. The defaults are placeholders: put in your own numbers.
From XACML to Apple
Anders’s roles, OPA’s milestones, the standards around them, and this show. Filter by topic.
Timeline
From XACML to Apple
- XACML 1.0
OASIS ratifies an XML-based standard for access control policies (Wikipedia, on this page).
- Solentro
Anders starts as a full stack web developer, to June 2014 (LinkedIn).
- OpenID Connect
Published by the OpenID Foundation (Wikipedia, on this page).
- Bisnode
Developer, then tech lead from August 2015 to October 2016 (LinkedIn, on this page).
- The CNCF
Founded alongside Kubernetes 1.0 (Wikipedia).
- The first commit
Tim Hinrichs's first commit in OPA, eight years old on December 28, 2023 (OPA, YouTube).
- Curity
Tech lead on an identity product, to August 2018 (LinkedIn, on this page).
- CNCF sandbox
OPA joins the CNCF sandbox (CNCF).
- Back at Bisnode
Developer advocate, to December 2020 (LinkedIn, on this page).
- Incubation
OPA moves to CNCF incubation, a year after the sandbox (CNCF).
- Styra
Developer advocate for OPA (LinkedIn, on this page).
- OPA graduates
At the CNCF, with maintainers from Google, Microsoft, VMware and Styra (CNCF, on this page).
- Episode 18
Anders on the show (Podbean, transcript).
- Developer relations manager
At Styra, to August 2025 (LinkedIn).
- 2022 in review
Anders on OPA's first full year as a graduated project (OPA, on this page).
- 2023 in review
Anders's review of OPA's year (OPA).
- OPA 1.0 is coming
Anders on what changes, and what won't break (OPA).
- OPA 1.0
After nearly 10 years and more than 450 developers (OPA).
- A maintainer session
Charlie Egan and Anders introduce OPA on the CNCF channel (YouTube, on this page).
- Swift OPA
Native policy evaluation for Swift (OPA).
- Apple
Open source and developer relations (LinkedIn).
- OPA's creators join Apple
With many of Styra's team, and Styra's tools move into the OPA project (OPA).
- A decade of OPA
Anders's keynote at the Nordic APIs Platform Summit (LinkedIn, YouTube).
- Episode 81
Eric Olden of Strata Identity on AuthZEN (episode page).
- Authorization API 1.0
A Final Specification from the OpenID AuthZEN Working Group (OpenID Foundation).
- Everpure
Pure Storage, where Jon used OPA, rebrands (Wikipedia, on this page).
- Episode 89
Graham Neray of Oso on checks at every level of the stack (episode page).
- A full house
Anders on the OPA maintainer track session (LinkedIn).
- opa-java-wasm
The Java SDK for Wasm-compiled policies moves into the OPA GitHub organization (OPA).
What to do this week
Five things, in the order of the episode.
- Find where decisions get made. List the services that make their own authorization decisions, as in A different answer in every team.
- Log every decision the same way. Record each decision with its input and its result in one format, so an audit has something to read, as in A different answer in every team.
- Move policy into version control. Give every policy review, tests and history, and a release cycle of its own, as in Policy on its own release cycle.
- Put a decision point in front of agent tools. Have the harness ask for a decision before each tool call, as in What happened after the tape.
- Get help with it. Our AI Access Control Audits check who and what can reach your systems, the Secure MCP Program reviews the tools your agents connect to, and vCISO Services help you decide where authorization decisions should live. If you want to talk it through, book 15 minutes with us.