open-policy-agent/opa

Health v2 · maintenance only

Adoption not part of the score

12164 stars · 1663 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Open Policy Agent (OPA) is a general-purpose, open-source policy engine that unifies policy enforcement across the stack using a high-level declarative language called Rego. It decouples policy decision-making from enforcement, letting applications, Kubernetes, API gateways, and CI/CD pipelines query OPA for context-aware authorization and compliance decisions.

Use cases

• enforce fine-grained authorization for microservices and APIs
• write Kubernetes admission control policies
• offload authorization decisions from Envoy proxies
• define policy as code for CI/CD pipelines
• audit and replay policy decisions for compliance
• filter data with partial evaluation for SQL and other systems
• validate Terraform or infrastructure-as-code configurations

When to choose

• you need unified, declarative policy enforcement across services, Kubernetes, and CI/CD
• you want to decouple authorization logic from application code
• you need audit trails and replayable policy decisions for compliance
• you want a CNCF-graduated, widely adopted policy engine with strong ecosystem support

When to avoid

• you only need simple role-based access control built into a single app
• your team cannot invest in learning the Rego language
• you need a database-backed identity and permission system rather than a policy decision engine

Facets

service · maturity stable

authorization security api-framework cli security cloud-computing infrastructure-as-code developer-tools microservices go windows self-hosted cloud rego policy-as-code cncf admission-control compliance audit envoy kubernetes-admission policy-decision-point policy-engine devops docker kubernetes linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="open-policy-agent/opa")