permitio/opal

Features

• Policy Push Distribution - Pushes immediate authorization updates from Git repositories or APIs to remote agents using webhooks and pub/sub messaging.
• Policy Administration Servers - Provides a centralized administration server as a container to manage policy and data synchronization across distributed agents.
• Distributed Authorization Management - Implements a centralized management plane for deploying and monitoring distributed policy engines across microservices.
• Centralized Policy Administration - Centralizes the administration of authorization policies while deploying decentralized decision points across microservices.
• Data Synchronization WebSockets - Distributes authorization policies and data to agents in real time using WebSocket connections for instant updates.
• Provider-Based Fetching - Aggregates authorization state from external APIs and databases using specialized provider extensions.
• Authorization Data Retrievals - Retrieves authorization relationships and attributes from multiple databases, APIs, and third-party services.
• Data Tenant Isolators - Separates authorization data for multiple tenants by assigning each a unique destination path in the policy engine.
• Policy Cache Synchronization - Automatically populates local policy engine caches by fetching application state from external databases and APIs.
• Local Caching Layers - Maintains a local memory-resident cache of policies and data to reduce latency and server load.
• Authorization Policy Isolators - Isolates authorization policies and data per tenant using scoped distribution and topic subscriptions.
• Real-time Data Synchronization - Fetches application state from external sources to populate policy agent caches in real time.
• State Change Notifications - Propagates data-change notifications via pub/sub to trigger agents to refresh their local authorization caches from external databases.
• Topic-Based Data Isolation - Filters data updates by assigning clients to specific topics or identifiers to ensure tenant data isolation.
• Real-Time Runtime Updates - Updates authorization data across remote agents instantly via CLI or API to change access decisions without restarts.
• Authorization Agents - Distributes client images that embed policy engines or connect to standalone instances for low-latency authorization.
• Authorization Infrastructure Orchestration - Provides a management plane to orchestrate the deployment and monitoring of distributed policy servers and agents.
• Git-Based Policy Synchronization - Automates the distribution of policies from Git repositories to agents using webhooks for immediate updates.
• Policy Distribution Systems - Provides a synchronization layer that pushes real-time authorization updates from Git or APIs to decentralized decision points.
• Scoped Policy Distribution - Enables clients to subscribe to specific directories within a policy repository to receive only relevant scoped updates.
• Authorization Query Engines - Provides a system that evaluates access requests and delivers real-time permission decisions based on policies and data.
• Policy Administration Servers - Acts as a centralized server for managing and orchestrating authorization policies across distributed OPA and Cedar agents.
• OPA Synchronization - Synchronizes real-time policy and data updates specifically for Open Policy Agent engines.
• Scope-Based Isolation - Serves distinct authorization policies and data sources to different client groups using unique identifiers for tenant isolation.
• Policy and Data Decoupling - Decouples policy code managed via version control from authorization data retrieved from external databases and APIs.
• Pub/Sub Event Distribution - Broadcasts real-time policy and data updates to distributed agents using a pub/sub event distribution model.
• Server Instance Synchronization - Broadcasts real-time policy and data updates across distributed server instances using a pub/sub messaging backbone.
• Policy Change Notifications - Pushes update messages to subscribed clients via pub/sub when policy changes occur in Git.
• Authorization Data Fetchers - Provides customizable data retrieval functions to synchronize application state with distributed policy engines.
• Offline Policy Fallbacks - Loads policies from a local backup file to maintain authorization capabilities when the central server is unreachable.
• Offline Operation Modes - Enables agents to load policies from a local backup file when the central administration server is unreachable.
• Authorization Data Connectors - Implements a pluggable driver architecture to retrieve authorization data from various SaaS services and proprietary APIs.
• Policy Synchronization Webhooks - Triggers immediate policy updates via webhooks from Git providers to eliminate the need for periodic polling.
• Incremental Policy Sync - Supports downloading complete or delta policy bundles from a server to synchronize local state with the latest commit.
• Sidecar Deployment Orchestration - Orchestrates the deployment of distributed policy engines as sidecars within Kubernetes clusters.
• Kubernetes Deployments - Installs the administration layer into a Kubernetes cluster using a package manager with custom YAML configurations.
• Policy Engine Orchestration - Orchestrates the deployment and updates of multiple policy engine instances to ensure consistency across an environment.
• Policy Bundle Synchronization - Fetches compressed policy archives from HTTP or S3 servers and distributes updates via polling or webhooks.
• Agent Sidecars - Runs policy engines as managed sidecar processes local to the application for low-latency authorization decisions.
• External API Data Fetching - Retrieves updated authorization values from internal or third-party APIs and injects them into the data hierarchy.
• Authenticated Data Fetching - Implements mechanisms for securely retrieving authorization data from external APIs using authentication credentials.
• Client-to-Server Authentication - Secures communication by requiring signed tokens and key pairs for agents authenticating to the administration server.
• Dynamic Policy Scoping - Updates authorization scopes and repository bindings at runtime via API without requiring service restarts.
• Agent Data Isolation - Restricts the authorization data loaded into specific agents via topic subscriptions to reduce memory and resource consumption.
• Policy Source Tracking - Synchronizes authorization policies from diverse sources including Git repositories and API bundle servers using secure authentication.
• JWT Authentications - Secures communication between the administration server and distributed agents using signed JSON Web Tokens.
• Distributed Pub-Sub Adapters - Synchronizes multiple server instances using a pub/sub backbone to ensure consistent policy delivery across a large cluster.
• Policy Engine Coordination - Provides capabilities to deploy and manage multiple policy engines in parallel to meet diverse functional requirements.
• Agent Health Monitoring - Provides tools for tracking the operational status and connectivity of distributed authorization agents.
• Synchronization State Monitoring - Reports agent operational status by evaluating the freshness and consistency of its synchronization state.
• Topic-Based Agent Targeting - Directs data updates to specific subsets of clients using topics to deliver only relevant configuration data.
• HTTP Health Probes - Exposes liveness and readiness HTTP probes to signal the health of servers and agents.
• Policy Agent Management - Manages the lifecycle and operational status of distributed policy engine agents as child processes.
• Access Control Frameworks - Real-time administration layer for pushing policy updates to engines.
• Security and Compliance - Administration layer for policy engines.

Star history