Episode 156: OPA - SpiceDB Connector

December 4, 2025 · 1 min read

Roland wrote a plugin that adds support for querying and manipulating relations from Authzed SpiceDB via gRPC as custom builtin commands for Open Policy Agent. Why does this make sense? How's it working out? Join us to find out!

#Speakers

Host: Mike Schwartz, Founder/CEO Gluu
Guest: Roland Baum, Founder at umbrella.associates GmbH

#Homework

Github Project

#Takeaways

Enterprises will need a "hybrid" approach to policy management: ReBAC, ABAC, TBAC... yes please.
"Authorized" v. "PDP" v. "Engine" ... there is some overlap of jargon here which eventually needs to be clarified by Authzenterati.
SpiceDB is a simple, scalable implementation of Zanzibar that is less feature rich then Indy Kite (3Edges).
Graph-based PDPs need to be kept in sync with application data. There was a good talk on this topic at Kubecon in relation to OpenFGA, but any graph system has the same challenge. It makes one wonder if graph based PDPs are like database indexes optimized for relationship queries.

Related

We use analytics cookies to measure which pages are useful, so we can improve them. They are only set if you accept. Essential cookies needed for the site to work are always on. See our privacy policy.