Open Policy Agent

Open Policy Agent (OPA) is a general-purpose policy engine that enables unified, context-aware policy enforcement across the entire technology stack, from microservices and APIs to Kubernetes, CI/CD pipelines, and cloud infrastructure. Written in Go with an embeddable design, OPA decouples policy decision-making from application logic, allowing security and platform teams to centrally manage shared policies while development teams extend them as needed within a unified policy framework. Policies are expressed in Rego, a purpose-built declarative query language inspired by Datalog that supports complex rule composition, data joins, and pattern matching. The Rego Playground provides an interactive browser-based environment for writing, testing, and sharing policies. OPA is widely used for Kubernetes admission control via Gatekeeper, API authorization, microservice authorization, CI/CD pipeline policies, data filtering, and cloud resource compliance enforcement. The engine can be deployed as a standalone service, a sidecar container, or embedded as a library, and integrates with HTTP API gateways including Envoy, Kong, and Istio through extensible plugins. As a CNCF graduated project, OPA is trusted by major enterprises including Allstate, Atlassian, Bloomberg, BNY, Capital One, Cisco, Goldman Sachs, Intuit, Marsh McLennan, Pinterest, T-Mobile, TripAdvisor, Vodafone, Zalando, and SugarCRM, who use it to manage millions of policy evaluations per second across critical infrastructure. The project supports features like decision logging for audit trails, distributed policy bundles for large-scale deployments, and built-in data caching for high-performance evaluation. OPA is open-source under the Apache License 2.0.