Access control in a multi-tenant platform gets messy fast when every service that needs to make a decision ends up with its own rules for making it: one set of rules for SSH access, another for the API, a third for who gets a Kubernetes service account token.
In k8shell, we consolidated all of this into a single OPA/Rego policy service, called over gRPC from every component that needs an authorization decision: SSH authentication, our identity gRPC API, on-demand Kubernetes TokenRequest issuance, and personal access token scoping.

We'll walk through how a single external policy point handles fundamentally different actions and protocols through one consistent scope grammar (domain:action:qualifier:constraint) from coarse decisions like "can this user onboard at all" to fine-grained ones like "can this token read this user's own profile, but nobody else's." We'll cover how onboarding policy evaluation attaches obligations (sudo, roles, blueprints) to a new identity at first login, how personal access tokens get scoped and constrained down from a user's full policy at issuance time, and the tradeoffs of centralizing authz versus letting each service own its own checks.