OPA/AuthZEN enterprise authorization experiment across Britannia and Aurelia

[bluntmachetti]

Experiment summary

This is a self-reported external-consumer experiment using the released idcognito-synthworld 0.16.0 package. It evaluates one OPA policy and a thin AuthZEN-style adapter across two fictional enterprise topologies, Britannia and Aurelia.

The experiment deliberately treats SynthWorld as a dependency. It does not modify SynthWorld or import repository examples or tests. The projector receives the split public deliverable and writes the derived policy and request inputs used by OPA, the adapter, and the system-under-test runner. None of those capabilities has an evaluator mount; only the offline scorer reads evaluator artifacts.

Results

• Effective decisions: 649 / 649
• Final decisions after lifecycle replay: 648 / 649
• Policy and adapter controls: 20 / 20 refused as expected
• Request-binding mutation controls: 16 / 16 refused as expected
• Seal and replay controls: 20 / 20 behaved as expected
• Deterministic reproduction comparison: 175 / 175 files byte-identical
• A clean run from the published reproduction ZIP completed successfully

The single final-decision miss is retained as a visible result rather than hidden by an aggregate score.

Reproduce or inspect

The repository evidence page records the boundary, denominators, limitations, and exact verification commands:

https://bluntmachetti.github.io/synthworld/experiments/opa-authzen-enterprise-authorization/

The authoritative frozen release contains a minimal reproduction kit, a complete reference run, checksums, and machine-readable asset metadata:

https://github.com/bluntmachetti/synthworld/releases/tag/enterprise-authorization-opa-authzen-0.16.0-2

Publication revision 2 supersedes revision 1, which accidentally retained unmanifested Python bytecode caches in its ZIPs. Revision 2 removes only those generated files; inputs, source, evidence, results, and internal checksums are unchanged. Both immutable releases retain the correction history.

Download the release assets, verify them with sha256sum -c SHA256SUMS, then unpack the reproduction kit and run ./run.sh. Docker Compose supplies the infrastructure; the Python environment is built from the hash-pinned lock file.

Scope and limitations

This is not a maintained SynthWorld adapter, a conformance or certification claim, a vendor comparison, or evidence that this policy is production-ready. The policy was iteratively corrected while aggregate metrics were visible, and one author wrote both the scenario overlay and the OPA policy. Aurelia uses a schema the mapping algorithm was not written against, but two similarly authored topology documents are not a representative generalization sample.

The isolation checker passed and its standalone evidence ships in the reference ZIP, but a missing controls mount caused both published submission seals to record isolation_evidence as null. The release therefore does not provide a seal-bound isolation proof. Team-level responsibility is modeled, while explicit person assignment for every agent is not. SynthWorld 0.16.0 had no HTML renderer for these enterprise artifact types, and the experiment did not add one.

Questions, independent reproductions, altered-policy results, and links to other experiment artifacts are welcome in this category. Maintainers are not committing to operate or support third-party experiment infrastructure.