Undefined Is Not False

An API asks OPA for a decision on every request.

package authz
import rego.v1

allow if {
  input.action == "read"
  input.subject.tenant == input.resource.tenant
}

// POST http://opa:8181/v1/data/authz  ->  { "result": { ... } }
const res = await fetch(OPA_URL, {
  method: 'POST',
  body: JSON.stringify({ input })
})
const { result } = await res.json()

if (result.allow === false) {
  return reply.code(403).send()
}
return handler(req, reply)

A user in tenant acme requests a resource in tenant kestrel. What happens?

The guard works here but fails for other actions: read is covered, and any other action leaves allow undefined and is therefore denied.

The rule body fails, so allow is undefined and the key is simply absent from result. undefined === false is false, the guard is skipped, and the handler runs the cross-tenant read.

OPA returns allow: false, because a complete rule that produces no value evaluates to the zero value of its type. The bug is somewhere else.

OPA returns an HTTP 500, because a complete rule whose body never succeeds is an evaluation error.