Unified security framework enforcing policies at AWS IAM and Linux kernel level

I'm architecting a complex multitenant data platform that spans cloud services & old school shared hosting - it requires a unified security framework that can enforce policies at both the AWS IAM and Linux kernel level (selinux, cgroups or similar)

I was recommended casbin & it looks amazing for the kind of complex policies I need (RBAC + usage credit limits, for example)

but it AIUI, it's opt-in - your program needs to explicitly check w/ casbin for auth before action, right?

In my case, I need the policies to be enforced by external services like IAM/selinux - is that doable with casbin?

the intersting question: https://discord.com/channels/1022748306096537660/1151583166449057802/1151584090642989247

You need to see if IAM/selinux supports external authorization modile

If they don't support, there's no way for Casbin side to step in

Yeah looks like not... Maybe I'm thinking about this wrong

maybe what I needed something more like "terraform for authorization" - is that cedar or OPA?