open-policy-agent/opa

What OPA does

Open Policy Agent (OPA) is a general-purpose policy engine written in Go. Instead of hardcoding authorization and compliance rules in each service, you write them in OPA's declarative Rego language and have services query OPA for a decision. OPA evaluates the rules plus the data you supply and returns an answer such as allow or deny, which the calling service then enforces. Typical questions include whether a user can call an operation on a resource, where a workload should be deployed, or which tags a resource needs before creation.

The same engine is used for API authorization, Kubernetes admission control, Terraform planning, Docker authorization, and SSH/sudo authorization; integration guides for these environments are on openpolicyagent.org. OPA is a graduated CNCF project announcement, and the repository ships the CLI, server binaries, container images, Go SDK, and REST API.

Getting started

You can write and share Rego in the browser with the Rego Playground; the access control examples are a reasonable first stop. For local work, install the VS Code extension to get diagnostics, debugging, and formatting, then follow the Running OPA instructions for the CLI. The wider documentation covers the Rego language and deployment/integration options; those pages are the authoritative source for exact commands.

The first policy decision follows this loop: write rules that allow or deny access, have your service send a query to OPA when a request arrives, and let the service accept or reject the request based on the returned decision. For a Go service, integrate through the Go SDK; services in other languages use the REST API.

Constraints and integration

OPA returns decisions; it does not enforce them itself. Your service, admission controller, or proxy must call OPA and act on the answer, so adopting OPA means changing those call sites and deciding where policy data lives. Rego is a declarative language with its own learning curve, and policies need to be versioned and tested like application code. Deployment choices include container images from Docker Hub and binaries from GitHub releases; choose one that matches your environment. Production adopters are listed in ADOPTERS.md. The project is Apache-2.0 licensed and underwent a third-party security audit described in the README.

HotRepo's take

OPA's recorded history on HotRepo is thin but points to a stable, established project rather than a fast-rising one: the only snapshot, dated 2026-11-06 on the Go daily list, shows 12,440 stars, 1,710 forks, and 10 stars gained that day at best position 18. The 2018 Hacker News thread drew 157 points and 39 comments, including a co-author offering to answer questions and a commenter noting that the "policy engine" framing is opaque to newcomers reply. That critique still describes the main onboarding challenge: the value is clear once you see a concrete allow/deny decision, which is why the Playground examples matter more than the tagline.