Policy
Policy decides what may come back from a data source, based on who is asking and what the content says. It filters connector results: before a browse, search, fetch or query result leaves Kamiwaza, policy can drop records and redact fields.
You write the rules as data, through Kamiwaza's API. An Open Policy Agent (OPA) that you run evaluates them.
The policy API is alpha. Its routes and request bodies may change in a later release.
Policy or a grant?
Policy only narrows. It can never give a user access to something they couldn't see without it.
| If the rule depends on... | Use |
|---|---|
| Who the user is, and which data source | A grant: share the data source with a workroom or group (Run Your Own Connector, step 3) |
| What is inside the records, or the user's attributes (team, region, marking level) | Policy |
Kamiwaza checks the grant first. A user without it never reaches policy.
Policy sees the user's declared attributes and marking level, not their name, ID or groups. So you can't write "if the user is Alice". Per-person access is a grant.
How it fits together
admin ──► Kamiwaza API: templates, constraints ──► policy bundle
│ pulled by
connector result ──► Kamiwaza ──── asks for a decision ──► your OPA
│
└──► filtered result to the user
| Term | Meaning |
|---|---|
| Template | A Rego module that defines a kind of rule, such as "drop records that contain these terms". Kamiwaza ships two; you can add your own. |
| Constraint | One use of a template: its parameters, and the data sources it applies to. |
| Revision | A numbered snapshot of every live template and constraint. Each change publishes a new one. |
| Bundle | The revision packaged for OPA. Your OPA downloads it from Kamiwaza. |
The model is Gatekeeper's:
if you have written a ConstraintTemplate and a constraint, this will look
familiar.
Kamiwaza is the source of truth. Templates and constraints are stored in Kamiwaza with every version kept, and nothing is overwritten. You don't load policies into the OPA yourself.
What happens when something goes wrong
Policy fails closed. With policy on, Kamiwaza withholds a result, and the caller gets an error rather than unfiltered data, when:
- the OPA can't be reached, times out, or returns an error;
- the OPA hasn't loaded the latest change for that data source yet. This is usually a few seconds after a change. Only data sources the change touched wait;
- a constraint's template is missing, or a template asks for something Kamiwaza can't apply yet.
A fetch for one item that policy drops returns 403.
Turning policy off while constraints are still attached doesn't turn the filtering off. Kamiwaza refuses calls to those data sources until you detach the constraints. See Turn policy off.
Currently supported
- You run the OPA. Kamiwaza doesn't ship one.
- Policy applies to connector results only.
- Drop and redact are supported. Mask and pseudonymize are reserved; a template that asks for them has its results withheld.
- There is no UI. Everything is done through the API.
- Policy is off by default.
Next
- Connect your OPA and turn policy on.
- Restrict a data source with the templates Kamiwaza ships.
- Optional: write your own template.
If results are withheld, see Troubleshooting.