Do we have any tool to convert business rules in excel to OPA ?

[amnikhil79]

Do we have any tool to convert business rules in excel to OPA REGO ?
OPA Excel Converter and Excel2REGO are no longer available ?

[charlieegan3]

Hi @amnikhil79, I'm not aware of any such tools in the community. I'd imagine that any mapping from an Excel sheet to an OPA policy would be very use case dependent on both sides. That is, how the data in the sheet was structured, and how the policies were to be used.

I can imagine some data like this:

user	groups
charlie	editor
amy	superadmin
bob	member

That might turn into something like this in rego:

package play

import future.keywords.in

users := {
	"charlie": ["editor"],
	"amy": ["superadmin"],
	"bob": ["member"],
}

default allow := false

allow {
	"editor" in users[input.user]
}

Is that the kind of think you had in mind?

I think this would be very hard to generalise in a useful way, however, I'd be interested to learn more about your use case.

OPA Excel Converter and Excel2REGO are no longer available ?

I'm not sure exactly which tools you are referring to here 😃

[charlieegan3]

Ahh, I see 🙂

ChatGPT (Chat Generative Pre-trained Transformer) is an AI tool which is good at generating information in response to questions. Sadly, sometimes the information it produces is incorrect. That is the case here, there are no such tools (opa-excel-converter & excel2rego).

As I suggested in my initial response, such a tool would be hard to build in a generic way. However, I'd be happy to try and help you build something for your use case.

[Ronnie-personal]

Hi OPA community,

Does OPA have any plan to add another abstraction layer on top of rego?

This abstraction layer can generate rego rules based on business rules, and allows an author who is not trained in rego to define the authorization business rules, which will be automatically converted to rego and evaluated in PDP/OPA.

I heard that 'plainID' already offers similar low-code feature.

[anderseknert]

Hi @Ronnie-personal! I believe most commercial platforms or products building on top of OPA offers something like that as a value-add. That's easy to do when you limit the domain to e.g. RBAC or something like that... and most often you don't even need to generate Rego — only the JSON data required by the domain model. OPA is however general purpose, so any abstraction layer supported in the OPA project would have to be as well. I'm not sure what that would look like, tbh.

[Ronnie-personal]

@anderseknert
Thanks for the reply! I got your point.

Could you please clarify the RBAC scenario? Are you suggesting that we do not need to write any OPA policy rules when using RBAC? In other words, do we not need OPA at all?

[anderseknert]

You'll still need OPA, you just don't (always) need to generate Rego dynamically. Say you have an RBAC policy like below:

package play

import future.keywords.contains
import future.keywords.if
import future.keywords.in

default allow := false

user_permissions contains permission if {
	some role in input.user.roles
	some permission in data.permissions[role]
}

required_permissions contains permission if {
	some permission in data.resources[input.request.path].required_permissions
}

allow if object.subset(user_permissions, required_permissions)

All the Rego rules do here is to:

1. collect the user permissions from input and data
2. collect required permissions from input (path) and data (path -> permissions mapping)
3. ensure that all required permissions are in the users permissions for the request

A simple policy like this allows you to:

1. Add new roles
2. Add new roles -> permission bindings
3. Add new resources

By only modifying data — not policy.

Full example here: https://play.openpolicyagent.org/p/z3Z4MwGgX9