Open Policy Agent (OPA)

OPA uses Rego, a high-level declarative language purpose-built for expressing complex policies over structured data. Instead of scripting procedural checks, you define rules that evaluate to true or false.

• Query-based decisions: Ask OPA arbitrary questions like allow = true by evaluating rules against input JSON.
• Data-centric logic: Policies reason over a snapshot of the world represented as nested JSON documents.
• Example: A rule granting read access only if input.user.role == "admin" and input.resource.owner == input.user.id.

OPA runs as a sidecar, daemon, or library, completely separating policy decisions from the services they govern. Applications query OPA via a simple REST API or gRPC, receiving a binary allow/deny decision.

• No service code changes: Policy logic is externalized, enabling updates without rebuilding or redeploying applications.
• Unified enforcement: The same policy engine can govern Kubernetes admission control, API authorization, and Terraform infrastructure changes.
• Latency-optimized: Policy decisions are made in-memory, typically in < 1 millisecond.

OPA evaluates policies against the full context of a request, combining real-time input attributes with external data pulled from databases or APIs.

• Attribute-Based Access Control (ABAC): Decisions factor in user attributes, resource metadata, geolocation, and time of day.
• Dynamic data injection: The data document can be populated with organizational hierarchies, compliance classifications, or real-time threat intelligence.
• Example: A policy that denies access if input.user.location is not in an approved jurisdiction list loaded from a Data Residency registry.

OPA is the standard policy engine for the Cloud Native Computing Foundation (CNCF) ecosystem, deeply integrated with Kubernetes via the Gatekeeper and Kyverno projects.

• Kubernetes Admission Control: Validate, mutate, or deny resource creation requests before they persist to etcd.
• Terraform Plan Evaluation: Assess infrastructure-as-code plans against security and cost policies before provisioning.
• Envoy & Service Mesh: Enforce fine-grained API authorization at the proxy layer using OPA's Envoy plugin.

OPA transforms static compliance documents into executable code, enabling continuous, automated auditing rather than periodic manual reviews.

• Regulatory mapping: Codify rules from GDPR, HIPAA, or Schrems II directly into Rego policies.
• Drift detection: Continuously evaluate the current state of infrastructure against desired compliance posture.
• Remediation: Integrate with CI/CD pipelines to block non-compliant deployments automatically, enforcing Data Sovereignty requirements at the deployment gate.

OPA can output every policy decision as a structured JSON log entry, creating an immutable audit trail for forensic analysis and compliance reporting.

• Decision provenance: Logs capture the exact policy version, input context, and resulting decision.
• Centralized aggregation: Stream decision logs to security information and event management (SIEM) systems for anomaly detection.
• Transparency: Provides verifiable proof to auditors that every access request was evaluated against the defined Attribute-Based Access Control (ABAC) rules.

The methodology of writing security and governance rules in a high-level programming language to manage and automate policy enforcement. Policy-as-Code treats policies like application source code, enabling version control, peer review, and automated testing.

• Declarative Intent: Specify the desired state of authorization, not the procedural steps to achieve it.
• CI/CD Integration: Embed policy checks directly into deployment pipelines to shift security left.
• Artifact Versioning: Store policy bundles in container registries for immutable, auditable deployments.

An access control paradigm that grants user permissions based on a combination of attributes, such as department, location, and clearance level. OPA is a natural engine for ABAC because it evaluates arbitrary structured data.

• Context-Aware: Decisions consider user attributes, resource metadata, and environmental context like time of day.
• Fine-Grained: Move beyond coarse role-based models to dynamic, risk-adaptive authorization.
• External Data Sources: OPA can pull real-time attributes from external APIs using the http.send built-in.

The deployment architectures for integrating OPA into distributed systems. A sidecar runs OPA as a container alongside each service instance, while a gateway centralizes policy decisions at the API entry point.

• Envoy Integration: Use the External Authorization API to offload decisions to OPA for every API request.
• Kubernetes Admission Control: Validate and mutate resource configurations before they are persisted to etcd.
• Latency Optimization: Sidecar deployments minimize network hops, keeping authorization latency under 1 millisecond.

The physical or geographic location where an organization's data is stored, governed by the laws of that specific jurisdiction. OPA enforces data residency by evaluating policies that restrict data access based on the requester's geographic context.

• Geofencing Rules: Write policies that deny access if the user's IP address originates from a prohibited region.
• Storage Class Constraints: Ensure data is only persisted to cloud storage buckets in approved sovereign regions.
• Cross-Border Transfer Control: Prevent data egress by evaluating both source and destination attributes in a single policy.

The practice of defining regulatory policies and security checks in machine-readable configuration files to automate continuous compliance verification. OPA translates legal requirements into executable code.

• Automated Auditing: Continuously evaluate infrastructure state against compliance rules, not just at deployment time.
• Remediation: Combine OPA's decision output with controllers to automatically correct non-compliant configurations.
• Regulatory Mapping: Codify frameworks like GDPR, HIPAA, and PCI DSS into version-controlled policy bundles.