Good afternoon, is there anyone who has successfully linked opa (open policy agent) and spicedb? I saw there is an extension for opa that implements the spicedb contract. But I have not seen any mention of such successful integration. Please share your experience. Now I'm wondering whether it's worth moving in this direction or not.

not that i know of. policy engines like OPA and rebac systems like SpiceDB don't typically sit alongside each other in a system unless there are legacy reasons for it. they present two different solutions for the same problem, with a different set of tradeoffs and strengths. i'd also guess that the extension isn't to integrate the two but rather to say "look you can implement the same interface as SpiceDB but with OPA!" which is technically true but they're going to have different performance characteristics and different requirements of the client.

There is an existing OPA-based authorization system. However, a number of products required a huge number of direct access assignments for sub, privilege, and resource (which is very close to the acl/rebac component). OPA has such a large number of appointments that it is assumed that it simply cannot withstand without additional tools. Here I am looking for ways to find a solution to the problem: 1. There was an idea to leave opa as a "brain" that appeals to spicedb 2. Use some kind of graph storage and teach OPA to work with a graph 3. Use only spicedb in this product and keep two solutions for different cases. 4. Maybe some other option

1. that makes sense to me if your opa system is already in use and understood by the rest of your org 1. probably won't scale, at least not easily; this is exactly the problem that SpiceDB is designed to solve 1. this makes sense to me if the new product has stringent latency requirements - fewer hops is better i also have opinions on why i think that SpiceDB is a better solution than OPA for a lot of use cases, but we can save that for a later time

Probably spicedb can be used as PIP (Policy Information Point) in OPA. OPA has a

http.send()

function, which can be used to call

/permissions/check

endpoint.