Open Policy Agent (OPA) with Role-Based Access Control (RBAC) is how you stop that from happening again. It takes authorization out of application code and turns it into a powerful, centralized policy engine. With OPA, you decide who can do what—declaratively, consistently, and at scale.
RBAC in OPA starts with defining roles: admin, editor, viewer—whatever matches your domain. Roles are then mapped to permissions, the actual actions allowed. Users or services are bound to roles, and from there, OPA enforces every request against the defined policy. Many systems try to mix these rules inside the codebase, but this makes them hard to audit, test, and change without deployments. OPA decouples enforcement from implementation, letting you update policies in seconds without touching your core logic.
With OPA’s Rego language, you can express complex logic simply and predictably. Need to tie a role’s access to the time of day? Require two-factor authentication for certain actions? Restrict changes to resources by geography? You can write it once, test it, and roll it out safely across services and microservices.