Scholarlink

<p>Policy-as-code (<i>PaC</i>) has emerged as a key practice in development, security, and operations, enabling organizations to specify, manage, and enforce access control policies as part of the software delivery pipeline. At the core of <i>PaC</i>, <i>Rego</i>, the policy language of Open Policy Agent, is widely used to implement authorization rules in cloud-native and microservice environments. However, testing <i>Rego</i> policies remains a major challenge, as current practices rely heavily on manual or ad-hoc test case design, often leading to insufficient coverage and latent security risks. This article introduces <i>ReATest</i>, an automated approach to enhancing <i>PaC</i> workflows through systematic test case generation from <i>Rego</i> specifications. <i>ReATest</i> defines a specialized Rego Flow Graph (RFG) that represents the structural relationships among Rego rules, conditions, and policy decisions. This representation enables systematic exploration of policy execution paths to generate an initial test suite. The resulting suite is then optimized using the Grey Wolf Optimization algorithm to reduce redundant test cases and improve overall testing efficiency. The approach was evaluated on <i>Rego</i> policies from open-source repositories. Experimental results show that <i>ReATest</i> achieved an average 35.43% reduction in test suite size, retaining 64.57% of the generated test cases; overall, this corresponds to 69.77% fewer tests compared to the published baselines.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

ReATest: enhancing policy-as-code workflows through automated test case generation from Rego policies

  • 期刊论文

  • 发表日期：

    2026年7月25日

查看全文
  • Thanh-Binh Trinh,
  • Ngoc-Minh Le,
  • Nguyen Viet Ha

摘要

Policy-as-code (PaC) has emerged as a key practice in development, security, and operations, enabling organizations to specify, manage, and enforce access control policies as part of the software delivery pipeline. At the core of PaC, Rego, the policy language of Open Policy Agent, is widely used to implement authorization rules in cloud-native and microservice environments. However, testing Rego policies remains a major challenge, as current practices rely heavily on manual or ad-hoc test case design, often leading to insufficient coverage and latent security risks. This article introduces ReATest, an automated approach to enhancing PaC workflows through systematic test case generation from Rego specifications. ReATest defines a specialized Rego Flow Graph (RFG) that represents the structural relationships among Rego rules, conditions, and policy decisions. This representation enables systematic exploration of policy execution paths to generate an initial test suite. The resulting suite is then optimized using the Grey Wolf Optimization algorithm to reduce redundant test cases and improve overall testing efficiency. The approach was evaluated on Rego policies from open-source repositories. Experimental results show that ReATest achieved an average 35.43% reduction in test suite size, retaining 64.57% of the generated test cases; overall, this corresponds to 69.77% fewer tests compared to the published baselines.