Skip to content

RFC: Integrating local OPA policy evaluation alongside single-flight thundering herd protection #3

@beebeeVB

Description

@beebeeVB

Technical Background

Your current implementation of single-flight grouping for cold cache misses and stale refreshes handles basic backend database protection incredibly well. However, when upstream workers hit the proxy with a massive volume of mutating transactional operations (INSERT/UPDATE/DELETE queries that can't be cached) wrapped in complex, dirty parameter states, the backend can still face severe connection stress under retry loops.

Proposed Extension Mechanics

We have been benchmarking an architecture that combines structural payload flattening with local Open Policy Agent (OPA/Rego) evaluation right inside high-speed database proxy boundaries.

By introducing a local rule compiler running on the stream:

  1. Dynamic parameter trees are flattened into structured attribute indices in real-time.
  2. The attributes are matched against declarative performance boundaries (array caps, query depth limits) in <3ms, outputting a deterministic ALLOW/QUARANTINE decision before disk thread allocation.
  3. Every operation footprint is hashed via a multi-key SHA256 ledger, allowing the proxy's internal circuit breaker to instantly flag and block repeating, broken worker transaction signatures.

Curious if you see value in adding declarative, low-latency token-screening hooks directly inside transport-layer proxies to handle mutating payload anomalies, or if you prefer keeping proxy boundaries focused entirely on caching and connection routing?

(Core design & profile: https://linkedin.com/in/bhuwanbhandari99)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions