- 01Durable policy-as-code: source-controlled with mandatory peer review, unit tests for positive and negative cases, canary rollout (not big-bang), decision-log replay against new versions, and disciplined removal of deprecated policies (no 'just in case').
- 02Choose authorization model deliberately and mix: RBAC for coarse-grained, ReBAC (Zanzibar-style) for object-level (file shares, projects), ABAC for contextual (location, time, risk). Picking one and refusing to mix produces brittle policies.
- 03Performance is real. Policy evaluation is in the hot path — plan for caching, evaluator co-location with services, and a clear SLO. A 300ms decision will not survive a serious traffic environment.
- 04After the first 200 policies, operational discipline matters more than the language choice. CODEOWNERS, drift detection, and a deprecation policy are the difference between a working program and a graveyard of overlapping rules.
Open Policy Agent, AWS Cedar, and similar declarative policy languages give you version-controlled, testable, auditable access policies. They also produce a new operational discipline: policy as a first-class artifact that needs SDLC, not a wiki page.
What durable policy-as-code looks like
- 01Policy lives in source control with mandatory peer review
- 02Every policy has a unit test (positive and negative cases)
- 03Every policy change rolls out via canary, not big-bang
- 04Decision logs are sampled and replayed against new policy versions
- 05Deprecated policies are removed, not left as 'just in case'
The model question
Choose your authorization model deliberately: RBAC (roles), ABAC (attributes), ReBAC (relationships, à la Zanzibar). Most organizations need a mix — RBAC for coarse-grained, ReBAC for object-level (file shares, projects), ABAC for contextual (location, time, risk). Picking one and refusing to mix produces brittle policies.
Performance is real
Policy evaluation is in the hot path. Plan for caching, evaluator co-location with services, and a clear performance SLO. A 300ms policy decision will not survive a serious traffic environment.