Variable assignment when to use = and when to use:=

[peteroneilljr]

When writing a Rego Policy a variable can be assigned with either the = or the := sign. What is the right way to assign a variable with these signs?

Example:

Evaluates to true

package play

x = "hello"

d {
  x == "hello"
}

Also evaluates to true

package play

x := "hello"

d {
  x == "hello"
}

[peteroneilljr]

Oftentimes, := and = are interchangeable, specifically when assigning an unused global variable.

Things can get tricky when you have comprehensive policies and you have variable names that may overlap.

Let's look at the following example:

package play

x := "hello"

a {
  x = "world"  # rule fails because 'x' already has another value assigned
  x == "world" # not evaluated
}

b {
  y = "world"  # y does not exist, introduces a new variable binding
  y == "world" # succeeds
}

c {
  x := "world" # x is a fresh variable inside of this rule, the global var named 'x' does not interfere
  x == "world" # succeeds
}

d {
  x = "hello" # Variable assignment succeeds because the new value is the same as the current global value.
  x == "hello" # succeeds
}

To recap:

:=: Is a safer choice when assigning variables inside of a rule. If a variable was previously set outside of the rule, it does not affect the rule validation.
=: When written inside a rule, this will assign an unused variable or check that it is equal to the current global var.