Open Policy Agent

Open Policy Agent, usually called OPA, is a general-purpose policy engine. It separates a policy decision from the code that enforces that decision. Your application, proxy, cluster, or pipeline supplies structured input. OPA evaluates that input against policy and data, then returns a decision.

That separation matters when the same rule must apply in more than one place. An application can enforce authorization, a Kubernetes admission path can validate workloads, and a CI pipeline can check configuration. Each enforcement point stays responsible for acting on a decision. OPA stays responsible for evaluating the policy.