The AI Authorization Myth

It’s a common belief nowadays that AI — and mainly what most people think of as AI — LLMs, can solve most problems fast and reliably. So, I don’t want to be that guy, but this is far from the truth. And allow me to make my argument with an example in the area I focus on: Authorization and mainly RBAC PDP engines.

Everyone thinks that we could feed an LLM with a policy description, some object and subject attributes, an action, and ask the LLM to give us the decision. And this is the million-dollar mistake companies seem willing to make. But where is the problem with this approach?

  • LLMs’ answers are not that deterministic. You need a lot of trial and error, a lot of prompt engineering, and a lot of guardrails to hopefully get the correct decision each time and in the format you expect
  • LLMs are expensive. Every request is multiple tokens, and tokens are the new money
  • LLMs are slow: Do you want sub-second responses? That ain’t gonna happen with an LLM
  • LLMs are not controlled by you. Yes, arguably you could deploy your own LLM, but the cost for running it in an environment that provides decent speed is prohibitive

Our Contrarian Approach

We embrace AI, but we do it in a smart and meaningful way. We ask it to do one single job: take the user’s natural language input, apply all necessary guardrails and instructions, and generate a precise OPA policy. That’s it. AI writes the policy once, then gets out of the way.

Then it’s battle-tested, traditional, and heavily optimized code that does the heavy lifting:

  • A comprehensive suite of smart connectors that users can select to fetch subject and object attributes — connectors for databases (MySQL, Postgres), MS Graph, MongoDB, Redis, REST services, and more
  • An automated framework that generates optimized authorization logic and deploys it directly to the cloud
  • Auto-generated clients in major languages (Python, JS, Java, Go) for seamless integration with the customer’s existing systems
  • A complete set of unit tests that enable customers to verify their policies work exactly as expected before going live
  • Real-time performance monitoring and audit logs that track every authorization decision without impacting speed

The Performance Proof

We talked earlier about speed, and that’s because we believe speed in a PDP engine can be a key differentiator for enhancing user experience.

That’s why we chose Golang behind our tailor-made engines. It’s fast, has a rich community, is compiled, natively async, and comes with a rising ecosystem. But why trust me when you can see the numbers?

10k requests in two minutes using locust framework
Great cache hit rate and sub-10ms response time

These are real numbers from our initial tests. We used a user as subject and a document as object. From the user email, our connector fetched and cached the user attributes. From a MongoDB database, our connector efficiently retrieves document attributes and brings the document sensitivity scores. And the OPA engine, based on the AI-generated policy, returned the final verdict. All of that in an amazing sub-10ms time.

When others talk in seconds, we talk in milliseconds. We see a speed improvement by a factor of ten.

Look at these real performance metrics:

  • Cache hits consistently deliver 4–6ms responses
  • Even cache misses stay under 30ms (27.2ms in our worst case)
  • 20,063 requests processed with 100% success rate
  • 99.08% cache hit rate under heavy load

Finding the missing part

But because behind the users, there is a company, we chose to provide complete and meaningful metrics and audit trails. Remember the last time you searched logs for hours, just to prove a user’s claim that they shouldn’t get blocked? Well, that’s in the past. Our complete auditing will provide the answer immediately.

Look at what you get with every single authorization request:

  • Full timing breakdown (Engine: 0.0ms, OPA: 0.0ms, Total: 0.0ms)
  • Complete request attributes and user context
  • Detailed reasoning for every decision: “Access denied: Top secret items require CEO department OR USA residency”
  • Cache performance metrics
  • IP tracking and user agent details

And because we accused AI too much, and trust me the machines will rise eventually, we chose to use AI a little bit more in our product. Ask and you shall receive, they say. A smart bot will be there for org admins to answer questions on why someone got or didn’t get access.

Our motto: What’s better for searching? Having an espresso and getting the answer by your last sip.