Approval policies
Choose how an io.sign Virtual Signer decides whether to participate
Before participating in key generation, resharing, or signing, a Virtual Signer evaluates an approval policy. The policy returns approve, reject, or abstain; only approve makes the signer available to the operation.
Supported modes
| Mode | Use |
|---|---|
| Custom policy server | Apply policy in an HTTPS service operated by your organisation. |
| Open Policy Agent | Evaluate Rego policies through OPA's Data API and a TLS path adapter. |
| Always approve | Smoke-test a development deployment only. Never assign production signing power to this mode. |
OPA and custom servers use the same Broker mode and wire contract. Set IOSIGN_SIGNER_BROKER_APPROVAL_MODE=api-approval; the configured HTTPS service determines whether the target is OPA or your application.
Fail-closed behavior
The Virtual Signer rejects when the policy service cannot provide a valid decision. Network failures and HTTP 5xx responses are retried; invalid responses and HTTP 4xx responses are rejected without retry. See Custom policy server for the exact behavior.
Choose a policy engine
- Choose OPA when your team wants version-controlled, testable Rego policy and can operate OPA behind a TLS adapter.
- Choose a custom policy server when decisions require an existing risk service, database, workflow, or implementation language.
- Use Always Approve only long enough to verify non-production connectivity.
Updated about 2 months ago