Skip to main content

Authorization Compiler

An authorization compiler turns a reviewable specification into executable policy artifacts. In Ninka the specification is a Tegata (手形) — a small declarative document — and the boundary runs: Tegata → validation → Rego/WASM → runtime. You review and approve the Tegata; you never hand-write the enforcement code.

Determinism is the point​

Compilation is a deterministic, pure function of the document: the same Tegata compiled with the same version of ninka-authz always produces byte-identical Rego/WASM — no randomness, no timestamps, no environment. Each Tegata has a fingerprint (tegata_hash), so approving the fingerprint approves exactly the code that runs; there is no gap between what you reviewed and what executes. Because the output is fixed, ninka verify can require byte-identity in CI, and a tampered or stale artifact can never pass.

Runs on OPA​

Ninka compiles to Rego/WASM that runs on OPA, the industry-standard engine — in-process, on every request, fail-closed. Ninka is not a new runtime or policy language; it adds the missing layer on top of OPA: a human-approvable contract between the policy author (often an AI agent) and the code that enforces decisions.

The pieces​

  • Tegata — the declarative policy you write and approve.
  • Sekisho — the compile-time inspection that checks a Tegata's meaning and rejects dangerous ones with one-line errors.

The flow: you or your AI agent write a Tegata → Sekisho inspects it → you approve the diff → the compiler emits byte-identical Rego/WASM → OPA enforces it on every request.