# Does AAP/AO support authorization by a signed decision from an independent external authority? **URL:** \ **Category:** Project Discussions\ **Tags:** aap\ **Created:** [October 3, 2026, 1:38pm UTC](https://forum.ansible.com/t/does-aap-ao-support-authorization-by-a-signed-decision-from-an-independent-external-authority/46407 "2026-10-03T13:38:57Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![terryncew\_openline](https://avatars.discourse-cdn.com/v4/letter/t/aca169/32.png) [@terryncew\_openline](https://forum.ansible.com/u/terryncew_openline)\ **Post date:** [October 3, 2026, 1:38pm UTC](https://forum.ansible.com/t/does-aap-ao-support-authorization-by-a-signed-decision-from-an-independent-external-authority/46407/1 "2026-10-03T13:38:57Z")
AAP 2.7 can offload execution policy decisions to an external OPA server. Does AAP or Automation Orchestrator support a job being authorized by a signed decision issued by an independent external authority, without first translating that authority into customer-authored OPA policy or Red Hat-managed RBAC? If yes, what supported interface or artifact format carries that authority into the execution decision? If no, would custom OPA verification logic be the required integration point? ---
**Author:** ![terryncew\_openline](https://avatars.discourse-cdn.com/v4/letter/t/aca169/32.png) [@terryncew\_openline](https://forum.ansible.com/u/terryncew_openline)\ **Post date:** [October 11, 2026, 2:36am UTC](https://forum.ansible.com/t/does-aap-ao-support-authorization-by-a-signed-decision-from-an-independent-external-authority/46407/2 "2026-10-11T02:36:12Z")
One follow-up bump. The question stands: does AAP or Automation Orchestrator have a supported interface for a job to be authorized by a signed decision from an independent external authority, without first translating that authority into customer-authored OPA policy or Red Hat-managed RBAC?