TL;DR: Access control decisions can become high-value security telemetry when policy engines like Open Policy Agent emit structured allow and deny events, and Wazuh shows how those logs can be ingested, correlated, and paired with file integrity monitoring to spot policy drift and unauthorized changes, according to Wazuh. The practical issue is not policy evaluation itself but whether teams can observe and trust the policy layer when access decisions change.
At a glance
What this is: Wazuh shows how OPA decision logs can be turned into searchable telemetry for access decisions, policy drift, and suspicious authorization patterns.
Why it matters: This matters because IAM and security teams often treat authorization as a control outcome, when the decision layer itself can become a monitoring signal for misuse, misconfiguration, and change control failures.
Context
Open Policy Agent turns access control into a policy decision layer, which means authorization outcomes can be logged as security data instead of disappearing inside application logic. That matters because many teams can enforce policy but cannot easily see how often it is changing, where denials are clustering, or whether policy files have been altered outside change control.
The governance gap is visibility, not policy syntax. When decision logs are monitored alongside file integrity events, access control becomes auditable telemetry that can support detection and investigation across cloud and on-premises environments. This is especially relevant where applications, APIs, and workload access depend on delegated policy enforcement rather than static role checks.
Key questions
Q: How should teams monitor authorization decisions as security telemetry?
A: Log allow and deny outcomes in a structured format, preserve the request context that influenced the decision, and send those records into detection tooling. The goal is to make access decisions searchable and correlate them with identity, device, and network signals so anomalous authorization behaviour becomes visible early.
Q: Why do policy changes create risk even when access requests still look normal?
A: Because the policy layer defines what is allowed. If rules are created, modified, or deleted without visibility, the enforcement result can change while the request path still appears legitimate. That is why policy integrity monitoring matters as much as request logging: it protects the trust basis of authorization itself.
Q: What are the signs that access control logging is actually useful?
A: Useful logging shows repeated denials, unusual combinations of role and endpoint, changes in device posture, and source IP patterns that stand out from normal access. If the logs cannot be searched, correlated, or tied to policy changes, they are collecting events rather than supporting detection.
Q: What should security teams do when authorization decisions and file changes diverge?
A: Treat that divergence as a governance alert. If access decisions remain stable while policy files are changing, or if policy changes appear without a corresponding change request, investigate immediately because the policy engine may still be working while the authorization rules have been altered.
Technical breakdown
How OPA decision logs become telemetry
OPA evaluates structured input against Rego policy and returns a decision object that includes allow or deny plus context such as reason and risk. When decision logging is enabled, each authorization event becomes a structured record that can be indexed, searched, and correlated. That changes access control from a hidden application outcome into a source of security evidence. The useful part is not the allow or deny result alone, but the surrounding metadata that makes patterns visible across users, paths, device posture, and source IPs.
Practical implication: treat authorization logs as first-class detection inputs, not as application noise.
Why policy file integrity matters for authorization trust
A policy engine is only as trustworthy as the policy files it is executing. If Rego policies are modified, added, or deleted without visibility, the decision stream can still look legitimate while enforcement has quietly changed. File integrity monitoring closes that gap by showing when the policy layer itself has been altered. This is a distinct control problem from detecting bad requests, because the risk is not only abuse of policy but abuse of the policy definition.
Practical implication: monitor policy repositories and runtime policy paths for unauthorised change, not just policy outcomes.
How access control telemetry supports investigation
Decision logs are useful because they preserve the context of authorization attempts. Repeated denials, unusual combinations of role and path, or a shift in device posture and IP patterns can point to probing, misconfiguration, or insider misuse. Correlating those logs with endpoint and integrity events gives analysts a way to separate routine enforcement from possible compromise. The operational value comes from combining decision context with change evidence, which is what turns access control into a defensible monitoring layer.
Practical implication: correlate denial patterns with file changes and endpoint activity before escalating an access anomaly.
Threat narrative
Attacker objective: The objective is to abuse or alter authorization behaviour so that protected resources become accessible without triggering obvious application failures.
- Entry occurs when an attacker or insider sends access requests that are evaluated by policy rather than hard-coded checks, creating a stream of authorization decisions that can mask probing activity.
- Credential or access abuse follows when repeated denied requests, excessive privilege attempts, or unusual device and IP attributes reveal someone testing control boundaries.
- Impact comes from policy drift or unauthorized policy changes, which can silently alter enforcement and allow access that should have remained blocked.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Access control telemetry is becoming part of the control plane, not just the audit trail. Once authorization decisions are logged in structured form, they can support detection, investigation, and compliance at the same time. That matters because modern access models increasingly depend on dynamic context such as role, device posture, and network source. Practitioners should treat decision logs as an operational security feed, not a compliance afterthought.
Policy drift is the real blind spot in policy-driven access systems. Teams often focus on whether the request was allowed or denied and miss the more important question of whether the policy that made the decision is still the intended policy. File integrity monitoring on policy paths gives the security team evidence when the trust basis of authorization has changed. Practitioners should build monitoring around policy definitions as well as policy outcomes.
Authorization evidence and identity evidence now need to be correlated. In environments where applications delegate access decisions to an external policy engine, identity signals, device posture, and request context all influence the decision. That creates a useful opportunity for detection, but only if the monitoring stack can join those signals consistently. Practitioners should design alerting so that access anomalies are assessed alongside change events and endpoint telemetry.
Decision logging sharpens the governance boundary between enforcement and observation. OPA enforces policy, while Wazuh-style monitoring observes the enforcement pattern and the integrity of the policy files behind it. That separation is valuable because it prevents teams from assuming that successful enforcement means trustworthy governance. Practitioners should use telemetry from the decision layer to validate that access control is still operating within approved bounds.
What this signals
Access-control observability is now a governance requirement in policy-driven environments. As more applications delegate authorization to external policy engines, teams need evidence that the policy layer has not drifted or been tampered with. The practical shift is from reviewing whether a request was blocked to proving that the rule set behind the block is still the approved one.
Decision logs close part of the identity visibility gap, but only if they are treated as a detection source. Authorization events capture role, request path, device posture, and source IP in one place, which makes them valuable for hunting and correlation. Practitioners should connect those signals to change control and endpoint monitoring rather than leaving them inside application logs.
Policy integrity is the named control gap here. In policy-based access control, the risk is not only unauthorised requests, but unauthorised rule changes that rewrite the decision boundary. That means access control governance must include integrity checks on the policy store, review on rule changes, and alerting on unexpected policy churn.
For practitioners
- Instrument policy decisions as security events Ingest OPA allow and deny decisions into the monitoring stack so access outcomes can be searched, correlated, and alerted on alongside other security signals.
- Monitor policy files with file integrity controls Track creation, modification, and deletion in the policy directory so changes to the authorization logic are visible as soon as they happen.
- Correlate denials with request context Alert on repeated denials, unusual role and path combinations, and changes in device posture or source IP because those patterns often indicate probing or misuse.
- Separate policy change review from access review Require independent review for policy edits so a modified rule cannot silently change authorization behaviour while decision logs still appear normal.
Key takeaways
- OPA decision logs turn authorization outcomes into telemetry that security teams can search, correlate, and investigate.
- The main governance risk is not the request itself but silent policy drift or tampering that changes enforcement without obvious application errors.
- Combining decision logs with file integrity monitoring gives teams a better way to detect misuse, review policy changes, and trust the access layer.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | OPA decision logging and policy enforcement directly govern access permissions and authorization outcomes. |
| Recommendation — Apply PR.AA-05 to validate that authorization decisions are logged, reviewable, and aligned to policy intent. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centers on access decisions, excessive permissions, and monitoring for unauthorized access patterns. |
| Recommendation — Use CIS-5 to review account and access assignments against the authorization signals your policy engine emits. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Decision logs become audit records that must be reviewed and correlated for suspicious access activity. |
| Recommendation — Apply AU-6 to review access decision logs for anomalous authorization patterns and policy drift indicators. | ||
| MITRE ATT&CK | TA0006;TA0007 — Credential Access; Discovery | Repeated denials and probing behavior map to credential and access discovery patterns seen in adversary activity. |
| Recommendation — Map repeated authorization anomalies to TA0006 and TA0007 when hunting for probing and misuse. | ||
Key terms
- Policy Decision Logging: The practice of recording which policy evaluated an access request, what conditions it checked and why it approved or denied the action. For MCP, this is essential because the reasoning behind access is as important as the access event itself.
- Policy Drift Detection: Policy drift detection is the process of identifying when an access policy no longer matches the intended rule or the current business context. It helps teams catch unauthorized changes, stale permissions, and exceptions that have quietly become the new normal, so governance stays aligned with actual identity and app usage.
- File Integrity Monitoring: File integrity monitoring is the practice of tracking critical files for unexpected changes in content, permissions, ownership, or metadata. It helps teams spot tampering, drift, and persistence attempts that can undermine identity and security controls. In mature programmes, it is tied to approved baselines and actionable change workflows.
- Authorization Telemetry: Authorization telemetry is the security data generated by access decisions, such as allow or deny outcomes, reasons, and request attributes. When monitored properly, it helps teams detect misuse, misconfiguration, and suspicious access patterns that would otherwise be hidden inside application logic.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the monitoring and lifecycle decisions that keep access systems trustworthy.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org