Dont centralize high-cardinality facts in Oso Cloud
Before pushing data into Oso Cloud, sort it: roles and global attributes go to Oso Cloud, high-cardinality or fast-changing data stays in your DB, and request-scoped values like the client IP or IDP token claims ride along as context facts that live only for the request.
Before pushing data into Oso Cloud, sort it: roles and global attributes go to Oso Cloud, high-cardinality or fast-changing data stays in your DB, and request-scoped values like the client IP or IDP token claims ride along as context facts that live only for the request. Syncing everything centrally buys you drift and sync jobs you did not need.
Context: Official docs (Overview of Facts, Oso Cloud): documents a gotcha that trips agents modeling authorization data. Oso Cloud centralizes facts for cross-service lookups, but the docs explicitly say to keep frequently-changing, high-cardinality data (like millions of files) and single-service data in the application DB instead. Centralize org and resource roles plus global flags like issuperadmin or isbanned; send ephemeral request data like IP or time of day as context facts.