permitio/opal

Health v2 · maintenance only

Adoption not part of the score

5505 stars · 295 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

OPAL (Open Policy Administration Layer) is an administration layer for policy engines such as Open Policy Agent (OPA) and Cedar Agent. It detects changes to policy and policy data in realtime and pushes live updates to policy agents via websocket pub/sub, keeping authorization layers in sync with application state.

Use cases

• keep OPA policies in sync with git in realtime
• push authorization data updates to policy agents over websockets
• manage policy distribution across microservices
• run Cedar Agent with realtime policy and data updates
• track policy changes from git or API bundle servers
• fetch authorization data from databases, APIs, S3, or SaaS services
• deploy fine-grained authorization at scale in cloud-native apps

When to choose

• you use OPA, Cedar Agent, or similar policy engines and need realtime policy/data updates
• your authorization decisions depend on fast-changing application state
• you run microservices that each need scoped policy and data subscriptions
• you want policy-as-code driven from git with automatic distribution

When to avoid

• you need a policy engine itself - OPAL manages engines, it is not one
• you need a database for permission data
• you have a single static service with rarely-changing policies where OPA's built-in bundle loading suffices

Facets

service · maturity active

authorization websocket middleware cli webhook security microservices developer-tools backend cloud-computing python self-hosted cross-platform open-policy-agent opa cedar policy-as-code realtime-updates pubsub policy-administration fine-grained-authorization openfga docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="permitio/opal")