Skip to content
SPECIFICTION
Get listed

Open Policy Agent

openpolicyagent.org

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit openpolicyagent.org
Spec score 8.2 #8 of 25 in Infrastructure Policy as Code Tools

What it is

Open Policy Agent (OPA) is a free, open-source policy engine that separates policy decisions from the systems that enforce them. It evaluates policies against structured input and can return structured data, making it applicable to microservices, Kubernetes, CI/CD pipelines, and API gateways. Policies use Rego, a declarative language for complex hierarchical data. Applications can request evaluations through a REST API, Go API, WebAssembly runtimes, or custom evaluators using OPA's intermediate representation. Bundles distribute policy and data to OPA instances, while discovery bundles carry configuration. Management interfaces support policy distribution, health and status checks, and decision logs. Listed integrations include Kubernetes, Terraform, Envoy, and code editors; the documentation recommends OPA Gatekeeper for Kubernetes admission control. Installation options cover macOS, Linux/Unix, Windows, and Docker. OPA's security guidance says API authentication and authorization are off by default and recommends configuring TLS, authentication, and authorization when securing the API. OPA is a graduated Cloud Native Computing Foundation project.

Spec sheet

Purpose
OPA is an open-source, general-purpose policy engine that unifies policy enforcement across software systems.Read 3 Oct 2026 · openpolicyagent.org
Deployment
The documentation describes installing OPA on macOS, Linux/Unix, and Windows, and running it with Docker.Read 3 Oct 2026 · openpolicyagent.org
Integrations
The project lists integrations for Kubernetes, Terraform, Envoy, and code editors.Read 3 Oct 2026 · openpolicyagent.org
Support
The project lists third-party companies offering commercial support and says the listings are not vetted endorsements.Read 3 Oct 2026 · openpolicyagent.org
API security
OPA's security guidance describes TLS, authentication, and Rego-based authorization, and says authentication and authorization are off by default.Read 2 Oct 2026 · openpolicyagent.org
Binary checksums
The installation guide says binary checksums are available by appending .sha256 to the binary filename.Read 2 Oct 2026 · openpolicyagent.org
Community support
The official site links to an OPA Slack community for users to talk with other users and maintainers.Read 2 Oct 2026 · openpolicyagent.org
Decision input and output
OPA evaluates policies against arbitrary structured input and can return arbitrary structured data as output.Read 3 Oct 2026 · openpolicyagent.org
Downloads
The official installation guide provides options for macOS, Linux/Unix, Windows, and Docker.Read 2 Oct 2026 · openpolicyagent.org
Governance
OPA is a graduated Cloud Native Computing Foundation project.Read 3 Oct 2026 · openpolicyagent.org
Integration options
OPA supports policy evaluation through a REST API, a Go API, WebAssembly, and custom evaluators using its intermediate representation.Read 2 Oct 2026 · openpolicyagent.org
Kubernetes
The OPA documentation recommends OPA Gatekeeper for Kubernetes admission control.Read 2 Oct 2026 · openpolicyagent.org
Policy distribution
OPA bundles distribute policy and data to OPA instances, while discovery bundles distribute flexible configuration.Read 3 Oct 2026 · openpolicyagent.org
Policy engine
OPA is an open source, general-purpose policy engine that separates policy decision-making from policy enforcement.Read 2 Oct 2026 · openpolicyagent.org
Policy evaluation
Policies can be evaluated through a REST API, the Go API, WebAssembly runtimes, or custom evaluators using OPA's intermediate representation.Read 3 Oct 2026 · openpolicyagent.org
Policy language
OPA policies are written in Rego, a declarative language designed for expressing rules over complex hierarchical data.Read 3 Oct 2026 · openpolicyagent.org
Policy management
OPA provides management interfaces for distributing policies, checking status and health, and collecting decision logs.Read 2 Oct 2026 · openpolicyagent.org
Project status
OPA is a graduated Cloud Native Computing Foundation project.Read 2 Oct 2026 · openpolicyagent.org
Security configuration
Authentication and authorization are off by default, and the security guide recommends configuring TLS, authentication, and authorization when securing the API.Read 3 Oct 2026 · openpolicyagent.org
Security reporting
The project asks security reporters to email its security team and says it aims to acknowledge reports and keep reporters informed about remediation.Read 3 Oct 2026 · openpolicyagent.org
Use cases
OPA can enforce policies in microservices, Kubernetes, CI/CD pipelines, and API gateways.Read 3 Oct 2026 · openpolicyagent.org

Plans and prices

Open Policy Agent Free Open-source policy engine · Apache License, Version 2.0 Read 3 Oct 2026 · openpolicyagent.org

Every Open Policy Agent plan and price →

Strong points and limits

Strong points

  • Evaluates policies against structured input.
  • Supports REST, Go, and WebAssembly evaluation.
  • Bundles distribute policy and data.
  • Integrations include Kubernetes, Terraform, and Envoy.

Limits

  • API authentication and authorization are off by default.
  • Kubernetes admission control documentation recommends Gatekeeper.

Who it suits

OPA suits teams that want to separate policy decisions from enforcement across services, infrastructure, or delivery pipelines. It is relevant to Kubernetes users, for whom the documentation recommends OPA Gatekeeper for admission control.

Verdict

OPA offers several integration and evaluation paths for applying policy across systems. Teams exposing its API should account for the default security settings and configure the recommended protections.

Where Specifiction places it

Alternatives to Open Policy AgentAll alternatives →