Meeting Notes - 2026-06-11

Attendees

• Alex Olivier
• Alex Babeanu (Indykite)
• Atul Tulshibagwale (CrowdStrike)
• John Jiang
• Robin Vanhove
• Michiel Trimpe
• Roland Baum
• Debayan Basu
• Edmund Jay

Agenda

• COAZ - review outstanding issues
• Mike Schwartz - Policy Stores Proposal overview
• How to handle workstreams going forward?
• Edmund/AlexO - Certification now in staging. Naming.
• Karl - Press release for Access Requests
• DavidB - Time of this call
• Upcoming events
• Identiverse - AuthZ Masterclass Monday

Process notes

• Note Well
• No meeting next week (IDV)
• Proposed PR - maybe better placed as a thought leadership blog post instead? Reframe as "the AI inflection point"

COAZ

• Open Issues
• CEL mapping https://github.com/openid/authzen/issues/491
• Issue is how to escape out if its a CEL
• Use the same escaping as JVM ecosystem
• Kro project has similiar https://kro.run/docs/concepts/rgd/cel-expressions/
• Use a single $ for a string which is CEL, and $$ to escape back to a literal

"x-authzen-mapping": {
"subject": { "type": "user", "id": "$token.sub" },
"context": { "agent": "$token.client_id" },
"evaluations": [
 { "action": { "name": "read" },
   "resource": {
       "type": "storage_object",
       "id": "$params.arguments.source" }
   },
 { "action": { "name": "write" },
   "resource": {
     "type": "storage_object",
     "id": "$$params.arguments.destination" }
 }
]
}

Actions:

• AlexO: check it works in reference implementation

Policy Stores Proposal

Policy Store

• Idea is to have a standard policy store format
• This is just for the structure of policy files in a (zip)
• Atul: What was the motivation?
• Portability and provenence of the policy files
• Need a standard asset which and treat like any other bit of software
• Atul: How does this help outside of Cedar/AVP etc
• When policies are being distributed to PDPs - possible across trust domains - there needs to be a standard format
• Just like the AuthZEN API is just the format of the request, not the policies themselves. This is the same for the artficat which moves policies (in whatever format) to PDPs
• Enables tooling to be built around it eg CI/CD
• Atul: Feels like we are jumping ahead to how we store policy?
• AlexB: Personally I like the proposal, if we don’t talk about standard policy language. That said policy distributions was part of the original mandate for AuthZEN, tabled for future
• Michiel: Currently when poeple want traceabilty for policies its usually githash ref
• John: There is a better need to standardize policy format, the storage/file format/transport is a different level similar to REST API is a wrapper around HTTP which is a different spec
• Robin: I would expect there to be a signature?
• There was a manifest which makes it more complicated