- pydantic — evaluates constraints in-process. Zero setup; what every example uses.
- WASM — compiles
policy.yaml→ Rego → WebAssembly. Production-ready, signed, byte-for-byte reproducible.
policy.yaml + policy.rego +
policy.wasm + a manifest with the SHA-256 of each artifact + an optional Ed25519
detached signature over the manifest.
Why a signed artifact
The WASM path exists because it gives you three things the in-process engine can’t:- Portability — one compiled
.wasmmodule, evaluated identically anywherewasmtimeruns. - Structured deny reasons — exactly which constraints failed, surfaced back to the caller.
- A trust chain — the signature chains back to the platform’s signing key, the same key that signs your biscuit tokens. Verifying the manifest hashes and the signature proves the whole bundle came from the trusted signer, untampered.
Where to go next
- WASM bundles — building a bundle, what each file
contains, the
opaprerequisite. - Signing & verification — keypairs, the
REQUIRE_SIGNATUREmatrix. - Local override — enforcing a bundle or YAML from disk with hot-reload.
- internals/rego-wasm — the engineering snapshot of the compile pipeline.