Policy engines externalize authorization logic from application code:
Open Policy Agent (OPA):
- Rego policy language
- Works with Kubernetes, APIs, databases
- Policies as code, version controlled
Cedar (AWS):
- Designed for fine-grained permissions
- Used in Amazon Verified Permissions
- Optimized for low-latency decisions
Benefits:
- Consistent policy enforcement across services
- Audit trail of all decisions
- Change policies without deploying code
In interviews, mention policy engines when discussing complex authorization at scale.