# permitio/opal

Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)

Repository: https://github.com/permitio/opal
Canonical: https://ross.abutalabs.com/products/opal
Homepage: https://opal.ac
Language: Python
License: Apache-2.0
License Family: permissive
Topics: authorization, policy-as-code, policy, realtime, websocket, pubsub, microservices, opa, opal, open-policy-agent, cedar, hacktoberfest, openfga
Last push: 2026-08-24T10:02:05+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 83, longevity 100
- inputs: {"age_days": 2026, "days_push": 9, "days_rel": 112, "gap_med": 27, "n_releases_24m": 16}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 5505, forks 295 (observed 2026-08-28T04:09:21.763889+00:00)

## What it is
OPAL (Open Policy Administration Layer) is an administration layer for policy engines such as Open Policy Agent (OPA) and Cedar Agent. It detects changes to policy and policy data in realtime and pushes live updates to policy agents via websocket pub/sub, keeping authorization layers in sync with application state.

## Use cases
- keep OPA policies in sync with git in realtime
- push authorization data updates to policy agents over websockets
- manage policy distribution across microservices
- run Cedar Agent with realtime policy and data updates
- track policy changes from git or API bundle servers
- fetch authorization data from databases, APIs, S3, or SaaS services
- deploy fine-grained authorization at scale in cloud-native apps

## When to choose
- you use OPA, Cedar Agent, or similar policy engines and need realtime policy/data updates
- your authorization decisions depend on fast-changing application state
- you run microservices that each need scoped policy and data subscriptions
- you want policy-as-code driven from git with automatic distribution

## When to avoid
- you need a policy engine itself - OPAL manages engines, it is not one
- you need a database for permission data
- you have a single static service with rarely-changing policies where OPA's built-in bundle loading suffices

## Facets
- artifact type: service
- maturity: active
- function: authorization, websocket, middleware, cli, webhook
- domain: security, microservices, developer-tools, backend, cloud-computing
- platform: python, self-hosted, cross-platform
- tags: open-policy-agent, opa, cedar, policy-as-code, realtime-updates, pubsub, policy-administration, fine-grained-authorization, openfga, docker, kubernetes

## Member repositories
- permitio/opal (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:21.763889+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:56:16.970437+00:00, confidence not recorded.
  - readme: https://github.com/permitio/opal (fetched 2026-08-28T04:09:21.763889+00:00, sha ef402d1f40ba)
  - homepage: https://opal.ac (fetched 2026-08-29T08:51:34.971724+00:00, sha 16537d62fd52)
  - site_page: https://opal.ac/getting-started/intro (fetched 2026-08-29T08:51:34.980998+00:00, sha dfbbcb5fbeb9)
  - site_page: https://opal.ac/getting-started/tldr (fetched 2026-08-29T08:51:34.983071+00:00, sha 1395273ce1d8)
  - site_page: https://opal.ac/getting-started/quickstart/opal-playground/overview (fetched 2026-08-29T08:51:34.984847+00:00, sha 3332f0d0885a)
  - site_page: https://opal.ac/getting-started/quickstart/opal-playground/run-server-and-client (fetched 2026-08-29T08:51:34.986615+00:00, sha a33c633b6498)
  - site_page: https://opal.ac/getting-started/quickstart/opal-playground/send-queries-to-opa (fetched 2026-08-29T08:51:34.988294+00:00, sha 29b5426ffc0e)
  - site_page: https://opal.ac/getting-started/quickstart/opal-playground/updating-the-policy (fetched 2026-08-29T08:51:34.990139+00:00, sha 57cc862b102f)
  - site_page: https://opal.ac/getting-started/quickstart/opal-playground/publishing-data-update (fetched 2026-08-29T08:51:34.992021+00:00, sha 513ff3a859c7)
  - site_page: https://opal.ac/getting-started/quickstart/docker-compose-config/overview (fetched 2026-08-29T08:51:34.994011+00:00, sha 80474752932f)
- Data as of 2026-08-30T08:39:29.467469+00:00.