Apply OPA policies
Decide not just whether a caller is authenticated, but whether that specific caller, claim, or credential is allowed to make this request at all. Field-level reference for every block here is in OPA policies →.
| Guide | What you will achieve |
|---|---|
| Control access to a surface with an OPA policy | Write a Rego policy definition and attach it to a surface, so requests are allowed or denied based on claims, request attributes, and organisational rules. |
| Roll out an OPA policy globally with monitor-only mode | Enforce one policy across every surface of a type, watching what it would deny before it can block any real traffic. |
| Verify caller credentials with VP evidence | Gate a policy on a cryptographically verified issuer and claims, not just a bearer token, without re-implementing verification yourself. |
Was this page helpful?
Glad to hear it. Thanks for letting us know.
Sorry to hear that. Thanks for letting us know.