opal

> And then you start to think about caching, data consistency, and so on If you are looking at OPA or Cedar as a standalone engine, this is the correct assumption. To avoid this hassle, there is an open-source tool called OPAL[1] that will let you run the policy engines with all the sync work without any investment in custom solutions. OPAL has a ready mechanism for data fetching and synchronization, so you can plug it into your application's data and not worry about the data. Disclaimer: I'm one of the OPA maintainers. [1] https://github.com/permitio/opal

Agree, the adoption is the key here. Regarding AuthZ, dynamic authorization layers that combine policy as code and synchronization engines such as OPAL[1] can make the authentication session smarter and more dynamic to multiple factors. Think of AuthZ layer that combines session geolocation, IP, fingerprints, etc. that enquires every time a new vector needed for the authorization action. 1 https://github.com/permitio/opal

Hi jzelinskie, Or from Permit here - The overall tone of your reply here reads as furious to me ,so I'd like to apologize for offending you, I tried to provide a balanced analysis here- and I think you'd agree it's a tough topic to cover - especially in a brief manner. I will say, I'm a big fan of your work at Authzed and SpiceDB, and while I think we probably don't see eye to eye on some topics like latency (e.g. I don't think same data-center is comparable to same node; or enough for realtime applications) ; I often recommend people to review and even use SpiceDB, it's my favorite open implementation of Google Zanzibar. I wouldn't call it a strawman at all in the context here - but rather a champion leading the charge. I do think in the end of the day, there's much to be said about combining policy-as-code at the edge with graph in the

I agree with you re:"I wouldn't say Cedar is directly competitive as SpiceDB" - I think Zanzibar and SpiceDB in particular can work well together with Cedar / OPA. By syncing SpiceDB via OPAL[0] into edge nodes with Cedar-agents[1]. [0]: https://github.com/permitio/opal [1]: https://github.com/permitio/cedar-agent