Open Policy Agent (OPA)

Open Policy Agent (OPA) is a general-purpose policy engine that decouples policy decisions from application code. Policies are written in Rego, a declarative query language purpose-built for expressing rules over structured data, and OPA evaluates those policies against a request or resource to return an allow/deny decision (or richer structured output) that the calling service then enforces.

Because OPA is a standalone engine rather than a library embedded in one application, it's commonly deployed as a sidecar, a Kubernetes admission controller that rejects non-compliant resources before they're created, or a policy check inside CI pipelines - one policy language reused across very different enforcement points instead of reimplementing rules per system.

OPA is a fit for platform and security teams that need policy enforced consistently across many services and layers of the stack. It's a different layer than Casbin or OpenFGA (also in this catalog): those are authorization libraries an application embeds directly to check permissions in its own code, while OPA is typically run as shared infrastructure that many different systems - application code among them - can query.