Evaluate multiple policies on multiple inputs

[rotemzenity]

Hi,
Our use case involves running hundreds of policies on multiple inputs,
What is the most effective way to do it?

• Run each policy multiple times for each input?
  Or
• Combine all inputs to a single input and run each policy only once?

Thanks for your help!

[anderseknert]

Hi @rotemzenity! 👋

That's an interesting question. If we are we talking about querying OPA over the REST API, compiling all the inputs into a single query would likely always be faster than sending multiple requests. If we're talking about querying OPA via the Go API, I guess it would depend, but my gut feeling is that reducing the number of queries is going to be faster still.

Could you provide an example of what such a policy and input might look like?

[rotemzenity]

Hi @anderseknert
Thanks for your reply.

Here is an example of policy and input.
As you can see, the policy accepts only a single input, so we need to run it multiple times, once for every input.
Will it be better to change the policy to run on a list of inputs instead?

validate_email_username[msg]{
    validate_email(input.username)
    msg = sprintf("%s is not an email", [input.username])
}

input = {
    "first name": "John",
    "last name": "Smith",
    "username": "[email protected]",
}
```


[anderseknert]

Yeah, if you have all the inputs avaliable, you'd definitely benefit from running the policy with all the inputs provided upfront. Something like:

package play

validate_email_username[msg]{
    username := inputs[_].username
    not valid_email(username)
    msg = sprintf("%s is not a valid email address", [username])
}

valid_email(str) {
    contains(str, "@")
}

inputs := [{
    "first name": "John",
    "last name": "Smith",
    "username": "[email protected]",
}, {
    "first name": "Bob",
    "last name": "Anderson",
    "username": "bobby",
}]

Of course, for most policies this won't work, since the input provided will be that from a single user / request.. but if that's not the context in which you're working, then you should defnitely use that to your advantage.

[rotemzenity]

Awesome thank you!