Dont centralize high-cardinality facts in Oso Cloud

TL;DR

Oso Cloud centralizes facts for cross-service lookups, but the docs explicitly say to keep frequently-changing, high-cardinality data (like millions of files) and single-service data in the application DB instead.

Steps

1. Before pushing data into Oso Cloud, sort it: roles and global attributes go to Oso Cloud, high-cardinality or fast-changing data stays in your DB, and request-scoped values like the client IP or IDP token claims ride along as context facts that live only for the request. Syncing everything centrally buys you drift and sync jobs you did not need.

When to use

You are seeing this: Before pushing data into Oso Cloud, sort it: roles and global attributes go to Oso Cloud, high-cardinality or fast-changing data stays in your DB, and request-scoped values like the client IP or IDP token claims ride along as context facts that live only... Use this skill when you run into "Dont centralize high-cardinality facts in Oso Cloud".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Overview of Facts, Oso Cloud): documents a gotcha that trips agents modeling authorization data. Oso Cloud centralizes facts for cross-service lookups, but the docs explicitly say to keep frequently-changing, high-cardinality data (like millions of files) and single-service data in the application DB instead. Centralize org and resource roles plus global flags like issuperadmin or isbanned; send ephemeral request data like IP or time of day as context facts.

Verified resolution: Before pushing data into Oso Cloud, sort it: roles and global attributes go to Oso Cloud, high-cardinality or fast-changing data stays in your DB, and request-scoped values like the client IP or IDP token claims ride along as context facts that live only for the request. Syncing everything centrally buys you drift and sync jobs you did not need.

Source URL: https://www.OSOHQ.COM/docs/develop/facts/overview