This flow covers dynamic grants and platform OPA policy. Status: grant storage/outbox and OpenFGA event consumption are Partially implemented ; normalized projection, OPA bundles, and complete reconciliation are Planned .
policy_lifecycle · author, publish, decide, revoke 01 / 08 ← →
A provider authors a grant. Policy Service validates it with Catalogue facts, commits it with an outbox event, and RabbitMQ delivers it to authorization projections. Consumers receive decisions at an enforcement point. Revocation denies before cleanup, and reconciliation compares source records with projections. author grant canonical facts atomic commit publish project + activate protected request check revisions revoke / expire deny first compare authority ↔ projections Provider / admin author · revoke Policy Service authority · version IMPLEMENTED Catalogue / User resource · org · subject facts PARTIAL Outbox stable event identity PARTIAL ADOPTION RabbitMQ confirm · retry · DLQ Authorization OpenFGA projection planned OPA data/bundle cache invalidation PARTIAL Consumer exercise grant Enforcement point apply every obligation PARTIAL
01 Author submits a grant A provider or organization administrator selects subject, resource, permission, validity, and typed conditions/obligations. The caller cannot upload executable policy or datastore queries.
02 Policy Service validates authority and shape The PAP verifies resource existence, ownership or administration, supported access mode, normalized identifiers, condition vocabulary, expiry bounds, and overlap rules.
03 Grant and outbox fact commit atomically The source record and versioned event are committed in one database transaction. A failed transaction creates neither.
04 RabbitMQ delivers the fact An exclusive outbox claim publishes the event. Consumers are idempotent; malformed or unsupported versions are quarantined rather than discarded.
05 Authorization projections update The projector writes durable grant state and the OpenFGA relationship. OPA receives normalized grant facts through the selected bundle/data mechanism; the exact OPA distribution topology is an open decision.
06 Grant participates in decisions A request can be allowed only after the active relationship and contextual policy both select the grant. The decision reports the grant ID and policy/relationship revisions.
07 Revocation or expiry denies Revocation becomes authoritative for denial immediately; relationship cleanup follows asynchronously. Expiry is evaluated against request time and cannot be extended by a stale cache.
08 Reconciliation proves convergence A scheduled reconciler compares source grants, durable projections, relationship tuples, and policy revisions. Drift is repaired or quarantined with an audit record.
OPA policy code follows a separate lifecycle: review → tests → immutable signed bundle → environment promotion → verification → readiness-gated activation → revision in every decision → rollback to a previous signed revision. The bundle authority, signer, and distribution mode remain open decisions and are not implied to exist.
Audit and observability
Grant ID and version, author, organization, resource, permission, condition schema version, outbox/event ID, projector state, OpenFGA model/store revision, OPA bundle revision, decision IDs, expiry/revocation time, and reconciliation result form the audit chain. Alerts cover outbox age, DLQ depth, projection lag, tuple/model failure, bundle mismatch, and stale-grant decisions.