-
Notifications
You must be signed in to change notification settings - Fork 57
Description
I was trying to figure out whether regorus supports partial evaluation (as outlined in the docs of the official implementation https://www.openpolicyagent.org/docs/filtering/partial-evaluation), to support use-cases like data filtering? From what I can tell this isn't possible right now, but it's also not quite clear to me whether adding support for that would be something that requires invasive changes to the engine, or it's just a specialized high-level interface that would work with the current internals.
Right now I'm doing policy enforcement/data filtering over lists of data by doing a best-effort approximation SQL query that mimicks the policy structure to retrieve a list of candidates, and then doing an allow query for each item in the set. This does work, but also risks either under-fetching (losing out on some items) or over-fetching (in certain edge-cases significant additional query latency from the DB). Optimally I could mostly re-use some of the Rego policy and build the queries based on partial evaluation.