Sorry, but as a programmer with 30 years experience...

[dharma66]

I find the rego documentation utterly incomprehensible. For example, I feel this is an important statement:
"When evaluating rule bodies, OPA searches for variable bindings that make all of the expressions true."
But what does that even mean?
What searches? What does it search?
I'm trying to write a simple policy "Dave can do a, b, c; Mary can do x, y, z), and after 2 days, all I can get from OPA are errors.

[anderseknert]

Hi Phil! And thanks for reaching out. I'll try my best to explain that sentence. A rego rule normally looks something like this:

allow {
    input.user.roles[_] == "librarian"
    startswith(input.request.path, "/books")
    input.request.method == "GET"
}

Now, the allow rule above will evaluate to true if all of the conditions in the body evaluate to true. If we were to rewrite this in a more traditional/imperative style pseudo-code, it might look something like:

allow = undefined
if (input.user.roles contains "librarian" && 
    startswith(input.request.path, "/books") && 
    input.request.method == "GET")
{
    allow = true
}

Another, perhaps more interactive, resource for learning Rego that you might want to check out is the Styra Academy.

If you want help along the way, I'm always happy to help on the OPA Slack too, but it's fine to ask questions here as well.