Hi all, can we disable capabilities of the integrated OPA somehow? For example, I want to forbid "http.send" completely, how can I do this?

Hi @Mario Enrico Ragucci, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.

Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?

* I don't have specific documentation on how to disable OPA built-in functions like

http.send

within Permit.io's integrated OPA/PDP setup. OPA itself supports restricting built-in functions through its configuration (using the

capabilities

setting) , but I couldn't find documentation on how this is exposed or configurable in the Permit.io PDP specifically. Check out these potentially useful sources: • FAQ | OPAL • Authorization with Open Policy Agent (OPA) • Best Practices for Microservice Authorization Would you like me to try to answer generally based on OPA's standard configuration options? * To help our engineers investigate this further, could you please share: 1. Which Workspace / Project / Env you are using 2. What calls you are performing (as SDK code or CURL) 3. Which PDP version you are running 4. Any relevant logs from your PDP

Hi @Mario Enrico Ragucci thanks for reaching out. I'll check and we will get back to you shortly.

Hey @Mario Enrico Ragucci, thank you for reaching out. You can customize the CLI arguments that would be passed to OPA when the OPAL Client would run it internally using the OPAL_INLINE_OPA_CONFIG I was not able to find a specific way to disable such capability though to give you a full example, but anything OPA configuration could be set here. If you would need a custom OPA build for that, you can also host OPAL Client Standalone that does not ship with any OPA engine internally, and host your custom OPA independently of the OPAL Client, letting the OPAL Client manage it externally. See OPAL_POLICY_STORE_URL for reference. You can also build a custom OPAL Client image, based on the official OPAL Client image or installing from the source, then customize it to include your custom OPA build. @Ask Inkeep Would be able to provide more examples and details about this. Let me know how it goes 💎

Thanks for tagging me @Dan. I'll look through relevant sources and get back to you shortly.