[DIFF] Policy-as-code access control — OPA/Rego integration

[ElioNeto]

Differentiator

Fine-grained, policy-based access control using Open Policy Agent Rego language.

Example

policy.rego:
allow { input.operation == "read" not startswith(input.key, "hr/") }
allow { input.operation == "read" startswith(input.key, "hr/") input.user.roles[_] == "hr" }

Features

• Per-key, per-user, per-operation authorization
• Hot-reload policies
• Audit log of denied access
• Built-in Rego evaluator (no external OPA server)

Impact

• HIPAA/SOC2 compliance
• Fine-grained access control unique in embedded DBs

[ElioNeto]

Implemented in commit 0871d91.