Skip to content

Enterprise authorization OPA/AuthZEN reference experiment (SynthWorld 0.16.0, revision 2)

Choose a tag to compare

View all tags
@bluntmachetti bluntmachetti released this 17 Aug 21:35
Immutable release. Only release title and notes can be modified.
enterprise-authorization-opa-authzen-0.16.0-2
3c64907
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Frozen enterprise authorization OPA/AuthZEN reference experiment

This is the authoritative publication of agent-auth-3, a frozen, unsupported
external-consumer experiment using idcognito-synthworld==0.16.0, Open Policy
Agent 1.4.2, and an experiment-owned adapter for OpenID Authorization API 1.0.

Publication revision 2 supersedes
enterprise-authorization-opa-authzen-0.16.0-1. Revision 1 accidentally retained
unmanifested Python bytecode caches in both ZIPs. This revision removes only those
generated cache files. Experiment inputs, source files, retained evidence, results,
and internal checksums are unchanged. The immutable revision 1 remains available
as a transparent record of the correction.

This experiment is evidence of what was run. It is not a maintained adapter,
AuthZEN conformance claim, product certification, vendor comparison, production
enforcement result, or general authorization-correctness claim.

The experiment maps two fictional organization topologies using one deterministic
method, projects only physically separated public artifacts into OPA, binds every
AuthZEN request entity and evaluation-context field to its public benchmark cell,
seals submissions before scoring, and opens evaluator truth only in the offline
scorer capability.

Recorded results

  • two topology lanes and 649 evaluation cells;
  • 649/649 effective authorization decisions correct;
  • 648/649 final decisions correct;
  • 20/20 deliberately faulty policy and adapter controls detected;
  • 16/16 fixed-cell-ID AuthZEN request mutations refused;
  • 20/20 missing, modified, cross-topology and cross-version seal controls passed;
  • 175/175 deterministic files byte-identical across two complete runs;
  • a fresh extraction of this revision's reproduction ZIP completed successfully;
  • every release and retained-reference checksum verified.

The residual binding errors are reported rather than hidden: canonical
account-to-principal binding is evaluator-only, so plausible same-kind substitutions
are not always decidable from public evidence.

Assets

  • enterprise-authorization-opa-authzen-0.16.0-2-reproduction-kit.zip
    (sha256:8a48b643dfaeb84d3d0ec5ecc0683c02cea109dbc73e4404928f91f4dfea9cfa):
    source, pinned dependencies, two topology inputs, policy, adapter, controls,
    documentation and the one-command workflow. It contains no generated public or
    evaluator artifacts.
  • enterprise-authorization-opa-authzen-0.16.0-2-reference-run.zip
    (sha256:ef73d2fd92973843412a63f6fb34ecc1077db72e71630dc300d9127f2530e997):
    the source plus retained public artifacts, physically separate evaluator truth,
    raw AuthZEN requests/responses, sealed submissions, controls and reports.
  • ASSET-METADATA.json records the correction, content-addressed source identity,
    versions, asset sizes, asset digests, result counts and unsupported claims.
  • SHA256SUMS verifies every custom release asset.

The experiment source was produced outside a Git repository. It is therefore bound
by a deterministic source-file-set digest and final file manifest rather than a
source commit; this limitation is explicit in ASSET-METADATA.json.

Reproduce

sha256sum -c SHA256SUMS
unzip enterprise-authorization-opa-authzen-0.16.0-2-reproduction-kit.zip
cd enterprise-authorization-opa-authzen-0.16.0-2-reproduction-kit
./run.sh

First execution may require network access to obtain digest-pinned images and
hash-pinned packages. After the first run, ./reproduce.sh --offline performs the
complete two-run byte-identity check using the retained cache.

This experiment implements one combined RBAC/ABAC/ReBAC policy. Its negative
controls are intentionally broken variants, not competing authorization strategies.
Accountability is team-level rather than an explicit individual person-to-agent
assignment, and no SynthWorld HTML renderer was used.

Community experiments are owned and supported by their authors. They may be listed
as self-reported results in the SynthWorld
Experiment Results
Discussion category. A listing is not review, reproduction, endorsement or a
support commitment by SynthWorld maintainers.

Assets 7
Loading