Skip to content

Enterprise authorization OPA/AuthZEN reference experiment (SynthWorld 0.16.0)

Choose a tag to compare

View all tags
@bluntmachetti bluntmachetti released this 17 Aug 21:29
Immutable release. Only release title and notes can be modified.
enterprise-authorization-opa-authzen-0.16.0-1
3c64907
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Frozen enterprise authorization OPA/AuthZEN reference experiment

This is a frozen, unsupported record of agent-auth-3, an external consumer
experiment using idcognito-synthworld==0.16.0, Open Policy Agent 1.4.2 and an
experiment-owned adapter for OpenID Authorization API 1.0.

It is evidence of what was run. It is not a maintained adapter, AuthZEN
conformance claim, product certification, vendor comparison, production
enforcement result, or general authorization-correctness claim.

The experiment maps two fictional organization topologies using one deterministic
method, projects only physically separated public artifacts into OPA, binds every
AuthZEN request entity and evaluation-context field to its public benchmark cell,
seals submissions before scoring, and opens evaluator truth only in the offline
scorer capability.

Recorded results

  • two topology lanes and 649 evaluation cells;
  • 649/649 effective authorization decisions correct;
  • 648/649 final decisions correct;
  • 20/20 deliberately faulty policy and adapter controls detected;
  • 16/16 fixed-cell-ID AuthZEN request mutations refused;
  • 20/20 missing, modified, cross-topology and cross-version seal controls passed;
  • 175/175 deterministic files byte-identical across two complete runs;
  • fresh extraction of the reproduction ZIP completed successfully;
  • every release and retained-reference checksum verified.

The residual binding errors are reported rather than hidden: canonical
account-to-principal binding is evaluator-only, so plausible same-kind substitutions
are not always decidable from public evidence.

Assets

  • enterprise-authorization-opa-authzen-0.16.0-1-reproduction-kit.zip
    (sha256:3fa4b331cf82601d09169b50056d02ca711e805c61c4eed36a80db6bfc70e22b):
    source, pinned dependencies, two topology inputs, policy, adapter, controls,
    documentation and the one-command workflow. It contains no generated public or
    evaluator artifacts.
  • enterprise-authorization-opa-authzen-0.16.0-1-reference-run.zip
    (sha256:ae4a5f78de9658c5411aa1cb68a91b764569d8ee5e7ed7e72068b41ee1ce69ee):
    the source plus retained public artifacts, physically separate evaluator truth,
    raw AuthZEN requests/responses, sealed submissions, controls and reports.
  • ASSET-METADATA.json records the content-addressed source identity, versions,
    asset sizes, asset digests, result counts and unsupported claims.
  • SHA256SUMS verifies every custom release asset.

The experiment source was produced outside a Git repository. It is therefore bound
by a deterministic source-file-set digest and the final file manifest rather than a
source commit; this limitation is explicit in ASSET-METADATA.json.

Reproduce

sha256sum -c SHA256SUMS
unzip enterprise-authorization-opa-authzen-0.16.0-1-reproduction-kit.zip
cd enterprise-authorization-opa-authzen-0.16.0-1-reproduction-kit
./run.sh

First execution may require network access to obtain digest-pinned images and
hash-pinned packages. After the first run, ./reproduce.sh --offline performs the
complete two-run byte-identity check using the retained cache.

This experiment implements one combined RBAC/ABAC/ReBAC policy. Its negative
controls are intentionally broken variants, not competing authorization strategies.
Accountability is team-level rather than an explicit individual person-to-agent
assignment, and no SynthWorld HTML renderer was used.

Community experiments are owned and supported by their authors. They may be listed
as self-reported results in the SynthWorld
Experiment Results
Discussion category. A listing is not review, reproduction, endorsement or a
support commitment by SynthWorld maintainers.

Assets 7
Loading