This message was deleted.

As for now, the OPA plugin for APISIX is a wrapper on top of OPA APIs and supports only OPA as a policy engine (as its name point 😉) The equivalent to OPA in Cedar world, is Cedar agent, not OPAL. OPAL could help with running Cedar agent together with OPA but cannot replace the engine in APISIX OPA plugin. To use Cedar in APISIX you can either call the Cedar APIs that OPAL expose (

is_authorized

) or create a plugin that will wrap the Cedar agent and function the same as the current OPA APISIX plugin.

You could potentially create a proxy solution that would accept the requests coming form the OPA plugin reshape them and pass them to Cedar-agent or AVP.