The Policies service persists and enforces Policies, which control access to all resources in Ditto.
TL;DR: The Policies service owns all Policy entities, persists them via event sourcing in MongoDB, and enforces authorization on policy-related commands using the policy itself.
Overview
The Policies service is responsible for the complete lifecycle of Policy entities – creation, modification, retrieval, and deletion. Every authorization decision for policy-level operations flows through this service.
How it works
Model
The service is built around the Policy entity:
Signals
Other services communicate with the Policies service through two signal types:
- PolicyCommands: Commands that the service processes (create, modify, retrieve, delete)
- PolicyEvents: Events emitted when policy entities change
Persistence
The Policies service uses Pekko persistence with event sourcing to persist changes and restore policies.
Enforcement
The service authorizes all policy signals using the policy’s own rules. In other words, you need the right permissions in a policy to modify that policy.