Policy-as-Code in the Wild: A Taxonomy and Dataset for Open Policy Agent from GitHub
This program is tentative and subject to change.
Policy-as-Code (PaC) enables the definition, management, and enforcement of policies and regulations using source code, thereby supporting the application of software engineering practices and tools to policy management. While the gray literature and industrial tools indicate PaC is increasingly used in organizations, there is little academic literature on the topic. Hence, to understand how PaC is used in practice and to create a representative dataset of PaC scripts, we conducted a repository mining study. We selected Open Policy Agent (OPA) as the PaC framework because it is widely used in academia and industry and serves as a de facto standard for PaC. By mining 73 public GitHub repositories using OPA, we created a multi-level policy taxonomy comprising 5 top-level categories and 28 unique subtype categories at the lowest level. We also created a curated dataset of 101 OPA policy files. We believe the taxonomy and dataset can help both researchers and practitioners understand the use cases of PaC and develop methods and tools to support automated policy management using PaC.
This program is tentative and subject to change.
Tue 17 MarDisplayed time zone: Athens change
14:00 - 15:30 | MSR4P&S - Session 1Workshops & Tutorials at Megaron Gamma 14:00-14:05: Welcome and Opening 14:05-14:50: Keynote | ||
14:50 20mTalk | Broken Access Control Risks in Open Source JavaScript Projects: A Security Analysis Workshops & Tutorials Rima Ayusinta Mid Sweden University, Rodi Jolak RISE Research Institutes of Sweden and Mid Sweden University, Raja Khurram Shahzad Mid Sweden University | ||
15:10 20mTalk | Policy-as-Code in the Wild: A Taxonomy and Dataset for Open Policy Agent from GitHub Workshops & Tutorials Can Önal JADS, Tilburg University, Indika Kumara Tilburg University, Filippo Scaramuzza Tilburg University and Eindhoven University of Technology, Marco Tonnarelli JADS - TU/e | ||