umbrella.associates releases Open Policy Agent extension for SpiceDB

umbrella.associates just released a new SpiceDB Extension for the Open Policy Agent (OPA), enabling OPA to serve as a Policy Decision Point (PDP) with both Policy-Based Access Control (PBAC) and Relationship-Based Access Control (ReBAC) capabilities. This development allows organizations to implement more granular and dynamic access control mechanisms, by integrating SpiceDB’s relationship-based model (ReBAC) with OPA’s policy-based decision-making framework.

Understanding OPA and PBAC

Open Policy Agent (OPA) is an open-source, general-purpose policy engine designed to enable unified, scalable policy enforcement across a wide range of platforms and services. It provides administrators with the flexibility to create and enforce fine-grained policies, ensuring consistent access control across environments. Policy-Based Access Control (PBAC) is a method where access to resources is determined by predefined policies, enabling organizations to implement structured rules for access decisions.

What Are SpiceDB, ReBAC, and Zanzibar?

AuthZed SpiceDB is an open-source database built to handle complex access control scenarios through relationships. Such Relationship-Based Access Control (ReBAC) allow managing permissions by evaluating the relationships between users, roles, and resources.
This concept was formalized by Google’s Zanzibar system , which was designed to manage dynamic, large-scale access control needs by basing decisions on the relationships between entities.

The significance of the Open Policy Agent Extension for SpiceDB: Fine-Grained Access Control

Using SpiceDB in Open Policy Agent combines the best of both PBAC and ReBAC approaches within the same policy decision framework. This integration allows Open Policy Agent to make access control decisions based not only on static policies, but also on more dynamic relationships between arbitrary entities, providing more precise and adaptable security measures.

Instead of giving broad access to entire systems or data sets, this approach allows enterprises to define who can access specific parts, down to the level of individual files, features, or actions, based on roles, tasks, or even context. By enabling fine-grained, real-time access control, the extension helps enterprises strengthen security posture while allowing for more context-aware and scalable access management in distributed environments.

Status

The Open Policy Agent Extension for SpiceDB is under active development. Contributions and feedback are welcome!

Follow the project on GitHub: https://github.com/umbrellaassociates/opa-spicedb
Follow us or reach out on LinkedIn: https://www.linkedin.com/company/umbrella-associates/

Support

We offer consulting , support and Training for Identity- & Access-Management, (Privileged) Access Management and Fine-Grained Access Control (FGAC).

Visit our Services for more information.