Open Policy Agent (OPA) — Unified Policy Engine for Cloud Native

What it is

Open Policy Agent (OPA) is a CNCF graduated project that provides a general-purpose policy engine. Instead of hardcoding authorization logic into each service, you write policies in Rego, a declarative language designed for structured data inspection. OPA evaluates those policies against JSON input and returns a decision.

OPA is used by platform engineers, DevOps teams, and security architects who need consistent policy enforcement across Kubernetes admission control, API authorization, Terraform plan validation, and CI/CD pipelines.

How it saves time or tokens

Without OPA, every service implements its own authorization checks, leading to duplicated logic and inconsistent enforcement. OPA centralizes policies so a single Rego file can govern access across dozens of services. When a compliance rule changes, you update one policy instead of patching every service. This reduces both engineering time and the risk of policy drift.

How to use

1. Install OPA:

brew install opa
# or download from https://github.com/open-policy-agent/opa/releases

1. Write a policy in Rego:

package authz

default allow = false

allow {
  input.method == "GET"
  input.path == "/public"
}

allow {
  input.user.role == "admin"
}

1. Evaluate the policy against input:

opa eval -i input.json -d policy.rego 'data.authz.allow'

Example

# Create input.json
cat > input.json << 'ENDJSON'
{
  "method": "GET",
  "path": "/public",
  "user": {"role": "viewer"}
}
ENDJSON

# Evaluate
opa eval -i input.json -d policy.rego 'data.authz.allow'
# Result: true (matches the GET /public rule)

Related on TokRepo

• AI tools for security — Security-focused tools and policies
• AI tools for DevOps — Infrastructure automation and operations tools

Common pitfalls

• Writing imperative-style Rego instead of declarative rules. Rego is not a scripting language; each rule body is a set of conditions that must all be true.
• Forgetting that OPA evaluates policies in memory. Loading very large datasets (millions of rows) into OPA data slows evaluation; use external data APIs for large lookups.
• Not testing policies before deploying them. OPA has a built-in test framework (opa test) that should be part of your CI pipeline.