Apply OPA policies
Decide not just whether a caller is authenticated, but whether that specific caller, claim, or credential is allowed to make this request at all. Field-level reference for every block here is in OPA policies →.
| Guide | What you will achieve |
|---|---|
| Control access to a surface with an OPA policy | Write a Rego policy definition and attach it to a surface, so requests are allowed or denied based on claims, request attributes, and organisational rules. |
| Roll out an OPA policy globally with monitor-only mode | Enforce one policy across every surface of a type, watching what it would deny before it can block any real traffic. |
| Verify caller credentials with VP evidence | Gate a policy on a cryptographically verified issuer and claims, not just a bearer token, without re-implementing verification yourself. |
Was this page helpful?
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.