Policy engines in Permit
Understand which policy engines evaluate Permit.io policies, and how each engine receives policy and data. This page is for developers and architects who want to know what runs inside the policy decision point (PDP) before they deploy it or write custom policy code.
How Permit supports several policy engines
Two components let Permit work with more than one policy engine:
| Component | What it does |
|---|---|
| Policy Editor | Generates policy as code from the roles, resources, and rules you configure |
| Open Policy Administration Layer (OPAL) | Runs next to the policy engine and keeps its policy and data up to date. The OPAL client can manage an OPA agent or a Cedar agent. |
| Engine | Policy language | Agent |
|---|---|---|
| Open Policy Agent (OPA) | Rego | OPA |
| AWS Cedar | Cedar | Cedar-agent |
Open Policy Agent (OPA) and Rego
OPA is a Cloud Native Computing Foundation (CNCF) graduated project, and the first engine Permit supported. The Permit PDP runs OPA and evaluates policy written in Rego. To add your own Rego next to the policy Permit generates, see Write custom policy with GitOps.
OPA PDP deployment diagram
In the diagram, the PDP runs in your network. Your service calls the PDP API through a Permit backend SDK, and the PDP API queries OPA. The OPAL client in the PDP receives policy and data update events from the OPAL server in Permit's cloud, fetches data from your data sources, and saves policy and data into OPA.
The Cloud Native Computing Foundation announced Open Policy Agent's graduation on February 4, 2021. Rego, OPA's policy language, was inspired by Datalog and extends it to work with structured formats like JSON, according to the OPA documentation.
Cedar-agent and Cedar
Cedar is an open-source policy engine and language created by AWS. Cedar-agent is an open-source project from Permit.io that runs Cedar as a standalone HTTP server with a policy store and a data store, the way you run OPA as an agent. The OPAL client can run Cedar-agent and keep its policy and data up to date.
Cedar PDP deployment diagram
In the diagram, the PDP API queries Cedar-agent for decisions and loads the data for each query from a cache. The OPAL client saves policy into Cedar-agent and data into the cache, from updates it receives from the OPAL server in Permit's cloud.
Next steps
- Control & Data planes
- Write custom policy with GitOps
- Deploy the PDP to production
- To discuss support for another policy engine, ask in the Permit Slack community