and the tradeoff between it and rebac is that OPA (and other ABAC systems) are more flexible - they can be stateful and temporal in ways that rebac systems can't