Open Policy Agent
General-purpose open-source policy engine; the de facto standard for cloud-native authorization with Rego.
About
Open Policy Agent (OPA) is an open-source, general-purpose policy engine created by Styra in 2016, donated to the Cloud Native Computing Foundation in 2018, and graduated in 2021. It implements unified authorization across the cloud-native stack by decoupling policy decisions from enforcement: policies are authored in the Rego language, evaluated against structured input, and the resulting allow/deny decision is consumed by Kubernetes admission controllers, API gateways, CI/CD pipelines, or application code.
OPA is widely deployed in production at companies including Netflix, Goldman Sachs, Atlassian, Capital One, and Pinterest, and brings policy into the as-code era with tooling for testing, distribution, and lifecycle management. Styra, founded by OPA's creators, offers commercial Enterprise OPA and the Styra DAS control plane for managing OPA fleets at scale.
What it can do
- General-purpose policy engine with the Rego policy language
- Decoupled policy decisions served over a REST API
- Kubernetes admission control
- CI/CD and infrastructure-as-code policy checks
- Microservice and API authorization
Setup
Install the OPA binary or run the official container image; write policies in Rego and integrate via the REST API, sidecar, or Kubernetes admission controller.
Prerequisites
A service, cluster, or pipeline to enforce policy on; basic familiarity with the Rego language.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 94; Trending score 88/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.