Fail Fast

[Ronnie-personal]

I would like to understand how does OPA work internally when evaluating a rule with multiple conditions.

Given following OPA example policy, does OPA evaluate 'var1' and 'var2' in parallel?
In case 'var1' already came back with a 'false' result, what will OPA do? Wait for 'var2'?

allowed if {
var1 == true
var2 == true
}

var1 if {

}

var2 if {

}

Thank you for helping with the question!

[srenatus]

Heya. First off, there's nothing "parallel" in OPA's evaluation, it's purely done expression-by-expression.

In your example

package ex
allows if {
  var1 == true
  var2 == true
}
var1 if ...
var2 if ...

a query for data.ex.allows would first evaluate var1. If that's false, it'll give up on that rule body of allows, try any subsequent rule bodies of allows. There are none here, so it's game over for that query, it'll become undefined.