Skip to content
FaradAiLab Docs
Enterprise Beta

Centralized OPA / Rego ABAC Policies

While FaradAiWire Core provides deterministic, local regex and schema validation, FaradAiLab Enterprise Edition equips enterprise security teams with Attribute-Based Access Control (ABAC) powered by the industry-standard Open Policy Agent (OPA) and the Rego query language.

This architecture enables organizations to enforce fine-grained, contextual security rules across thousands of distributed AI agent instances without touching individual developer configurations.

graph TD
    subgraph SecOpsWorkflow ["Enterprise Policy Lifecycle"]
        Author["Security Team Authors Rego Policies\n(GitLab / GitHub / IDE)"]
        CI["CI/CD Validation & Unit Testing\n(opa test / rego lint)"]
        Compiler["Control Plane Bundle Service\n(Sign & Compile Tarballs)"]
        Author --> CI --> Compiler
    end


    subgraph DistributionPlane ["Dynamic Distribution"]
        Compiler ==>|"Broadcast Signed Bundle"| FleetHub["Control Plane Sync Hub"]
        FleetHub ==>|"mTLS Stream"| EdgeNode1["Developer Workstation"]
        FleetHub ==>|"mTLS Stream"| EdgeNode2["CI/CD Runner"]
        FleetHub ==>|"mTLS Stream"| EdgeNode3["Production K8s Pod"]
    end


    subgraph EnforcementEngine ["Local Edge Evaluation (<0.5ms)"]
        EdgeNode1 -->|"OrderPolicy = 20 Hook"| LocalOPA["Embedded In-Memory OPA Engine"]
        LocalOPA -->|"Decision: Allow / Deny"| CorePEP["FaradAiWire Core PEP"]
    end

The Decoupled Policy Boundary (OrderPolicy = 20)

In alignment with ADR-0050 (Open Core Purity), FaradAiWire Core contains zero enterprise OPA dependencies or SaaS control plane artifacts. Instead, Core exposes a vendor-neutral, deterministic extension point:

  1. Precedence Constant: The pipeline constant OrderPolicy = 20 reserves the exact phase between fast deterministic filtering (prefill, DLP regex, schema validation) and external deep SLM checks.
  2. Error Protocol: When an OPA policy denies an agent tool call, the edge daemon returns canonical JSON-RPC error code -32003 (mcp.ErrPolicyDenied):
{
  "jsonrpc": "2.0",
  "id": "req_841029",
  "error": {
    "code": -32003,
    "message": "Policy authorization denied by enterprise OPA rule: [deny_prod_db_mutation]",
    "data": {
      "policy_id": "rule_corp_sec_04",
      "remediation": "Direct SQL mutation against production databases requires Jira approval ticket."
    }
  }
}

OPA Input Schema for Agent Tool Calls

When an agent invokes a tool (e.g. execute_command, query_database, read_file), the edge engine constructs an evaluation input document passed to the OPA engine:

{
  "context": {
    "tenant_id": "tenant_corp_748291",
    "workspace_id": "ws_fintech_core",
    "developer": {
      "email": "sarah.connor@acme.corp",
      "department": "Infrastructure",
      "groups": ["devs", "secops-auditors"]
    },
    "environment": {
      "type": "workstation",
      "os": "darwin",
      "ip_address": "10.240.12.84",
      "timestamp_utc": "2026-10-31T17:50:00Z"
    }
  },
  "request": {
    "tool_name": "execute_bash_command",
    "arguments": {
      "command": "kubectl delete pod -n production --all"
    },
    "risk_level": "critical"
  }
}

Example Enterprise Rego Policies

Enterprise security teams can write expressive, contextual rules using declarative Rego.

Rule 1: Preventing Destructive Commands on Production Namespaces

package faradaiwire.authz


default allow = false


# Allow all read-only inspection commands
allow {
    input.request.tool_name == "execute_bash_command"
    startswith(input.request.arguments.command, "kubectl get")
}


# Explicitly deny destructive commands on production
deny[msg] {
    input.request.tool_name == "execute_bash_command"
    cmd := input.request.arguments.command
    contains(cmd, "delete")
    contains(cmd, "production")
    msg := "Destructive operations on production namespaces are prohibited for AI agents."
}


# Allow by default if no explicit deny triggered and user belongs to SRE
allow {
    count(deny) == 0
    input.context.developer.groups[_] == "sre-core"
}

Rule 2: Restricting Filesystem Scope by Engineering Role

package faradaiwire.filesystem


default allow = false


# Developers cannot read credentials or secrets directories
deny[msg] {
    input.request.tool_name == "read_file"
    path := input.request.arguments.path
    regex.match(`(^|/)(\.env|\.aws/credentials|id_rsa|\.netrc)`, path)
    msg := sprintf("Access to secret or key file '%v' is blocked by organizational policy.", [path])
}


allow {
    count(deny) == 0
}

Policy Bundle Compilation & Deployment

FaradAiLab Enterprise Edition provides a complete GitOps workflow for policy management:

  1. Policy Repository: Teams store Rego rules in an enterprise Git repository.
  2. CI/CD Unit Tests: Pull requests run opa test against synthetic tool payloads to verify rule logic.
  3. Bundle Signing: The Control Plane signs compiled policy tarballs using an organization-specific X.509 private key.
  4. Hot Reload: Upon broadcast, the Fleet Gateway Daemon on each developer workstation verifies the cryptographic signature and hot-swaps the active OPA engine in under 5 milliseconds without restarting running agent sessions.

Next Steps