Rule tracing in Decision Logs

Enterprise OPA has support for logging the intermediate results of a decision request by setting the environment variable OPA_DECISIONS_INTERMEDIATE_RESULTS to one of three values: NO_VALUE, SHA256, and VALUE.

When this is set, then Enterprise OPA's decision logs will contain an object under the key intermediate_results. The structure of intermediate_keys is:

Configuration	Key description	Value description
NO_VALUE	Rule names	Nil
SHA256	Rule names	Array of SHA256 hashes of the computed rule evaluation results. Duplicate hashes are not included
VALUE	Rule names	Array of computed rule evaluation results. Duplicates are included.

Known Issue

This feature does not currently work with Enterprise OPA's decision log plugins, but it does work with Open Policy Agent decision log configurations.

For now, the following addition into your OPA configuration file should work

decision_logs:
  console: true

Examples

Shared Example Rego and HTTP calls

cats.rego:

package example.cats

import data.example.common as ex_common

default allow = false

allow {
	ex_common.user_is_vet(input.user)
}

allow {
	ex_common.user_is_customer_for_pet(input.user, input.pet)
}

common.rego:

package example.common

import rego.v1

_user_has_any_role(user, allowedRoles) if {
	some r in user.roles
	r in allowedRoles
}

_vet_roles := ["vet", "vet_assistant", "supervet"]

user_is_vet(user) if _user_has_any_role(user, _vet_roles)

user_is_customer_for_pet(user, pet) if user.id == pet.owner

user_is_customer_for_pet(user, pet) if user.id in pet.family

input.json:

{
  "input": {
    "correlationId": "0c85-9900",
    "user": {
      "id": "0077",
      "name": "Claire",
      "roles": [
        "vet"
      ]
    },
    "pet": {
      "name": "Garfield",
      "owner": "1155",
      "family": [
        "2255",
        "3355"
      ]
    }
  }
}

curl -d "@input.json" -X POST http://localhost:8181/v1/data/example/cats

NO_VALUE

{
  "intermediate_results": {
    "example.cats.allow": null,
    "example.common._user_has_any_role": null,
    "example.common._vet_roles": null,
    "example.common.user_is_customer_for_pet": null,
    "example.common.user_is_vet": null
  }
}

SHA256

note

Undefined responses will have a fake value of 000...000.

{
  "intermediate_results": {
    "example.cats.allow": [
      "9dcf97a184f32623d11a73124ceb99a5709b083721e878a16d78f596718ba7b2"
    ],
    "example.common._user_has_any_role": [
      "9dcf97a184f32623d11a73124ceb99a5709b083721e878a16d78f596718ba7b2"
    ],
    "example.common._vet_roles": [
      "468beb10a720e0ba8af357187e81f8314374756df2d5d4eda1c0c91d545ca878"
    ],
    "example.common.user_is_customer_for_pet": [
      "0000000000000000000000000000000000000000000000000000000000000000"
    ],
    "example.common.user_is_vet": [
      "9dcf97a184f32623d11a73124ceb99a5709b083721e878a16d78f596718ba7b2"
    ]
  }
}

VALUE

{
  "intermediate_results": {
    "example.cats.allow": [
      true
    ],
    "example.common._user_has_any_role": [
      true
    ],
    "example.common._vet_roles": [
      [
        "vet",
        "vet_assistant",
        "supervet"
      ]
    ],
    "example.common.user_is_customer_for_pet": [],
    "example.common.user_is_vet": [
      true
    ]
  }
}