hi all, am i correct that the policy store that's ...
# opalk
kevin
10/22/2025, 8:18 AMhi all, am i correct that the policy store that's supported out of box is git repository only?
i was thinking to use Zanzibar inspired DB as the policy store or data store:
https://github.com/permitio/opal/discussions/633#discussioncomment-10241951
a
Ask Inkeep
10/22/2025, 8:18 AMHi @kevin, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Ask Inkeep
10/22/2025, 8:18 AMNo, you're not correct - OPAL supports more than just Git repositories for policy storage.
Currently, OPAL supports two policy stores out of the box: *OPA* (Open Policy Agent) and *Cedar* (1) (2) . These are the policy engines that OPAL can sync policies and data to, not just Git repositories.
Regarding Zanzibar-inspired databases as policy stores, this is a direction OPAL is actively pursuing. According to the discussion you referenced, the way to implement this is to add OpenFGA, SpiceDB, Ory Keto, etc. as policy-stores, which would allow OPAL to sync data/policy to them on the fly - as it does for OPA and Cedar (3) .
There's actually an open GitHub issue with a $1,500 bounty for adding OpenFGA as a policy store to OPAL (4) . The acceptance criteria include:
• Configuring OpenFGA as a policy store in OPAL
• Auto-syncing OpenFGA models/policies from Git
• Supporting data fetching patterns and syncing from external data sources
• Providing working demos with ReBAC policies
So while Zanzibar-inspired stores aren't supported out of the box yet, they're on the roadmap and the team welcomes contributions to add this functionality (3) .
Ask Inkeep
10/22/2025, 8:19 AMTo learn more, see the sources I considered: [[1] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[2] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[3] Integration with Google Zanzibar inspired Authorization Frameworks like OpenFGA, SpiceDB, Ory Keto](https://github.com/permitio/opal/discussions/633) [[4] Add OpenFGA as a Policy Store](https://github.com/permitio/opal/issues/661)
k
kevin
10/22/2025, 8:23 AMlooks like the PR has been there for a while: OpenFGA Integration by daveads · Pull Request #673 · permitio/opal
oh i see it's approved, but not merged.
curious what's the future plan of this PR?
a
Alon Boshi
10/22/2025, 8:25 AMHey @kevin, thanks for reaching out, we will circle back to you soon
👋 1
thanks 1
o
Or Weis
10/22/2025, 9:21 AMHi @kevin,
Note: Google-Zanzibar implementations take a different approach (policy as data aka policy as graph) to policy than policy-as-code solutions like OPA or Cedar.
The question here would be what type of decision engine you want to use. Meaning you can’t really use a Zanzibar solution (like OpenFGA) as a policy source for an engine like OPA.
OpenFGA and OPA can both use Git as a source for their policies/schema.
Re the openFGA PR : it works in demo environments, but hasn’t gone through enough rigorous testing to be merged; we do plan to circle back to it, but don’t have the capacity at the moment - additional contribution/help to complete the effort here would be welcomed.
If you want to work with OpenFGA as your decision-engine with OPAL as an administration layer, you can potentially work with the fork of the pull-request.
👍 1
k
kevin
10/22/2025, 10:51 AMthanks for this. it helps and directs me to what to research on.
i've dig a bit deeper into articles & videos online, trying to understand the pros vs. cons. i am currently deciding between OpenFGA vs. OPAL, since they seem to be only two OSS solutions that support multi-tenancy.
from this discussion, it seems OPAL addresses the one concern that Zanzibar tries to solve: the evaluation speed.
• this is done by making data readily available in OPAL client
regarding the data size, OPAL client can retrieve scoped data that's needed (but i guess that data can still grow more than necessary because you don't know what's coming in)
the second point raised by Evan is strong consistency, Zanzibar uses zookie to ensure a stronger(i think?) guarantee a user has access to a resource at a point of time.
good thing is i can implement ReBAC with OPA / Cedar since i have many hierarchy data
o
Or Weis
10/22/2025, 2:31 PMthe second point raised by Evan is strong consistency, Zanzibar uses zookie to ensure a stronger(i think?) guarantee a user has access to a resource at a point of time.Instead of strong consistency the OPAL philosophy is extremely fast eventual consistency via event-driven distributed updates (sub 100ms), and even faster awareness of updates (basically realtime) - I’d claim this is practically better than strong consistency. You know an update is coming (so you know when you’re not consistent) and it will be delivered quickly
👍 1
k
kevin
10/23/2025, 1:19 AMthanks, after doing a lot of research, i think policy as data may better fit my needs, i'd need to query on subject, object and relations quite often, not just allow / deny response.
also considering further scaling, it would be hard to maintain many expressive policy data with PaC
afaik, Zanzibar implementation is in Permit io SaaS, not in open source, right?
p
permit support automation2
10/23/2025, 1:19 AMHey, thanks for reaching out !
It seems our team is a little busy right now, a human will be with you within the next hour or so.
In the meantime, can I help you ?
t
Thomas
10/23/2025, 1:38 AM@kevin correct. OPAL is the administrator of OPA for policy and data and assumes you create the policy and data.
k
kevin
10/23/2025, 4:43 AMi see, so if i want to use PaD with OPAL, i'd need to implement some agent and policy store first, right?
2 Views