In this talk, we'll walk through Plex's journey from role-based access to embracing policy.

To be fair, roles got us far at Plex. Roles can be a completely valid solution, especially for smaller systems. However, as we grew, we knew roles would not be able to solve all our problems forever. Our solution? Policy.

With policy, we are able to focus on what we actually care about: compliance. Additionally, policy enforcement tools such as Conftest and Open Policy Agent allow us to define our policies upfront and enforce them in our pipeline. This approach makes automation and autonomy a reality. By enforcing policies in pipelines, fewer manual reviews are required, and our team can focus on innovation rather than approving change requests.

Our journey is not over yet, but you can still come hear all about where we started with role-based access control, where we are today with policy, and where we want to be.