Open Policy Agent

Open Policy Agent is a general purpose policy engine that decouples policy decisions from the software enforcing them. Policies are written in Rego, its declarative language, and OPA answers queries by evaluating those policies against structured input, returning a decision the calling system then enforces.

Being general purpose rather than authorization specific is what has made it so widely adopted. The same engine decides whether a user may perform an action, whether a Kubernetes manifest may be admitted to a cluster, whether a Terraform plan complies with infrastructure standards and whether an API request should proceed. One policy language and one engine across those very different problems is a substantial saving in tooling and in the skills a team must maintain.

The separation between decision and enforcement is the design point. OPA never enforces anything itself, it answers a question, and the service that asked applies the answer. That keeps it embeddable anywhere and means adopting it does not require routing traffic through new infrastructure.

It is a graduated project in the Cloud Native Computing Foundation and is free and open source. The ecosystem includes OPA Gatekeeper for Kubernetes admission control, Conftest for testing configuration files, and Regal for linting Rego policies.