Can It Be Done? Building Fine-grained Access Control for Backstage with OPA

Backstage has emerged as a standout project, garnering attention for its innovative approach to managing software. While the platform provides robust capabilities for organizing and visualizing services and a rich plugin ecosystem, however the community has yet to settle on a standard for fine grained permissions. That's where Open Policy Agent (OPA), the CNCF's general purpose policy engine, comes in.

This talk seeks to address this by exploring the untapped potential of integrating the Open Policy Agent (OPA) into Backstage's ecosystem to facilitate RBAC. Traditionally, defining policies and permissions in Backstage has required writing TypeScript code. In this session, we will show how using a domain specific policy language can help write more expressive policies, faster and with greater consistency with policy elsewhere in the platform.

Attendees should leave the session with actionable steps to extend Backstage permissions with OPA and level up their security posture.