Open Policy Agent (OPA)
CNCF-graduated policy engine that evaluates policies written in Rego. Used for authorization across Kubernetes, microservices, and APIs. Requires learning a domain-specific language.
Open Policy Agent (OPA) is a CNCF-graduated, open-source policy engine that evaluates policies written in Rego, a declarative, Turing-complete policy language. OPA decouples policy decisions from application logic, enabling centralized policy management across Kubernetes admission control, API authorization, and infrastructure-as-code validation.
OPA's strengths
- Extremely powerful — Rego can express arbitrarily complex policies
- General-purpose — not limited to authorization; used for Terraform validation, CI/CD policies, etc.
- Large ecosystem — Styra DAS (management), OPA Gateways, Conftest
- Decouples policy from enforcement — clean PDP/PEP separation
The Rego learning curve
Rego's power is also its adoption barrier. It has a notoriously steep learning curve — cited by many teams as the primary reason they look for alternatives. WardenAuth's policy model uses structured JSON data (roles, permissions, scopes) instead of a domain-specific language, making it accessible to non-engineers.
WardenAuth vs OPA
WardenAuth provides RBAC, ReBAC, and ABAC via a visual dashboard and REST API — no Rego required. Read the full comparison.
Related terms
Role-Based Access Control (RBAC) grants permissions via roles. Attribute-Based Access Control (ABAC) evaluates arbitrary attributes (user, resource, environment) against policy rules.
The authorization engine that evaluates access requests against policies and returns allow/deny decisions. The PDP is the "brain" — it owns the rules and logic.
Managing authorization policies as version-controlled code artifacts rather than database records. Enables GitOps workflows: PR → review → merge → policy update via real-time sync (OPAL).