Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time Open Policy Agent policies — writing a policy bundle to the OPA server at checkout via HTTP PUT and deleting it at checkin, enabling zero-standing authorization for protected resources.

What you’ll accomplish:

Deploy and configure the Britive Access Broker with HTTP access to your OPA server
Configure checkout and checkin routines from the access-broker-examples repository
Register the OPA server as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out an OPA policy and verify the authorization decision changes

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker with network access to your OPA server REST API (typically port 8181)
An OPA server running in server mode (opa run --server)
curl available on the broker host

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker uses OPA’s REST API to PUT a policy bundle at checkout and DELETE it at checkin. This enables time-bound authorization — a policy that grants access to a protected resource only exists for the duration of the Britive session.

User → Britive Console → Access Broker → OPA REST API → PUT /v1/policies/<id> → DELETE /v1/policies/<id>

Onboarding the Application

Configure the broker for OPA policy management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under OPA/permissions/.

Using the Britive Console

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker with your Britive tenant.

Configure the broker scripts

git clone https://github.com/britive/access-broker-examples.git
# Copy OPA/permissions/ scripts to your broker's scripts directory

Verify OPA REST API access

From the broker host, confirm the OPA server is reachable:

curl http://opa.example.com:8181/v1/policies

Register the OPA server in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Define the resource type as OPAServer and enter the OPA server URL.

Using Shell

Key environment variables used by the broker scripts:

OPA_URL=http://opa.example.com:8181
OPA_POLICY_ID=britive_jit_access   # Unique policy ID
OPA_POLICY_REGO=...                 # Rego policy content (from Britive Secrets Store or variable)
BRITIVE_USER_EMAIL=user@example.com

The checkout routine PUTs the Rego policy to /v1/policies/<OPA_POLICY_ID>. The checkin routine DELETEs it.

Refer to the britive/access-broker-examples OPA/ directory for example Rego policies and the full script set.

Using Terraform

resource "britive_resource_manager_resource_type" "opa" {
  name        = "OPAServer"
  description = "Open Policy Agent server"

  parameters {
    param_name   = "opa_url"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "opa_prod" {
  name          = "opa-prod"
  resource_type = britive_resource_manager_resource_type.opa.name

  parameter_values = {
    opa_url = "http://opa.example.com:8181"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `OPA-DataAccess-Policy`)
Expiration	Set a max session duration (e.g., `1h`)

Associate resources

Under Associations, select the OPA server resource.

Add a permission

Under Permissions, select the checkout/checkin routine that manages the target Rego policy.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "opa_data" {
  name                = "OPA-DataAccess-Policy"
  expiration_duration = 3600000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "opa_perm" {
  profile_id = britive_resource_manager_profile.opa_data.id
  name       = "OPA-JIT-Policy"
  version    = "latest"

  variables {
    name              = "OPA_POLICY_ID"
    value             = "britive_jit_access"
    is_system_defined = false
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out.

Confirm the OPA policy was written

curl http://opa.example.com:8181/v1/policies/britive_jit_access

The response should contain your Rego policy body.

Test the authorization decision

Query OPA to confirm the policy is enforcing access as expected:

curl -X POST http://opa.example.com:8181/v1/data/britive/allow \
  -H "Content-Type: application/json" \
  -d '{"input": {"user": "user@example.com"}}'

Expected: {"result": true}

Check in

Return to My Access → click Check In. Query OPA again — the policy should be deleted and the decision should return false or an empty result.

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails	Broker cannot reach OPA server	Check network connectivity on port 8181 and OPA server firewall rules
PUT returns `400`	Invalid Rego syntax in the policy	Validate the Rego policy with `opa check` before deploying
Policy not deleted after checkin	DELETE request failed	Check broker logs for HTTP error responses from OPA

Next Steps

Britive documentation

Last updated on July 8, 2026