Skip to main content
InternalMarkdown

ADR 0029. Application-native authorization until a second service needs shared policy

Status​

Accepted (as listed in the decisions index).

Spec §17 allows OPA, Cerbos, or OpenFGA, and also allows ordinary database-backed authorization initially. A policy engine now would duplicate rules that already live next to Audience and integration checks in Nest.

Decision​

v1 authorization is application-native: Nest guards, authenticated integration audience, and PlayerPal permission checks in the service that owns the resource. IAM roles remain personas only (ADR 0011).

Revisit a policy engine when either is true: more than one service must enforce the same PlayerPal permissions, or non-engineers must author those rules without a deploy.

Consequences​

  • docs/authorization.md is the v1 rule list.
  • Adding OpenFGA or Cerbos without the trigger above is a reopen of this ADR, not a default improvement.