Open Policy Agent

As explained in Authorization in Action

Open Policy Agent is an open-source policy engine that evaluates declarative policies to make authorization and other policy decisions.

A microservices platform may need one policy engine to authorize API requests, validate Kubernetes resources, restrict CI/CD inputs, and enforce deployment rules. Open Policy Agent (OPA) provides that general-purpose decision engine, while Rego expresses declarative logic over JSON data. section 8.2

OPA can be embedded in applications, gateways, and controllers, keeping policies portable, testable, and independent of the systems they protect. It evaluates more than access control: policies can validate resources, enforce admission control, restrict inputs, or produce other structured decisions. section 8.2 section 8.2.4

Rego gives policy authors flexibility, but the policy structure must be designed deliberately:

• Define principals, actions, resources, and context in the request input; Rego supplies no built-in authorization model for them. section 8.2.3
• Represent identities and resources as JSON, with attributes such as identifiers, groups, departments, nested data, or organizational state. section 8.2.3
• Use runtime context such as time, location, network conditions, headers, or external data when decisions depend on environmental state. section 8.2.3
• Expect careful validation, analysis, and testing: flexible, untyped inputs can produce subtle bugs, while Rego has a steep learning curve. section 8.2.3 section 8.2.4

Cloud-native authorization

As infrastructure moves to Kubernetes and microservices, OPA can apply consistent decisions across APIs, CI/CD pipelines, container deployments, and controllers. Its flexibility suits infrastructure spanning multiple platforms, although teams seeking a purpose-built access-control model may prefer another framework. section 8.0 section 8.5.6

Figure 8.3 Strength map comparing five policy languages and frameworks (XACML, OPA/Rego, OpenFGA, AWS IAM, and Cedar) across the four PARC elements and portability. Darker shading indicates stronger, more native support for that element; lighter shading indicates partial or minimal support. This visual emphasizes how each system’s design highlights different aspects of authorization, from attribute-rich context handling to typed principals and explicit resource modeling.

Compare OPA/Rego with XACML, OpenFGA, AWS IAM, and Cedar across principal, action, resource, context, and portability support. section 8.5.6

How Authorization in Action covers it

How deep it goes

Explains Rego inputs and PARC elements in detail, then stops short of prescribing a built-in authorization structure.

Examples

Uses Kubernetes validation, API input restriction, admission control, CI/CD enforcement, and multi-platform infrastructure authorization.

What it assumes

Assumes familiarity with distributed systems and authorization concerns while defining principals, actions, resources, and context explicitly.

What you can do after

Apply OPA and Rego to express portable policy logic over structured requests and infrastructure data.

How it connects

Connects policy evaluation with Rego, authorization, Kubernetes, microservices, JSON, XACML, OpenFGA, AWS IAM, and Cedar.

liveBookmanning.com

Read Authorization in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Effective Platform EngineeringOpen Policy Agent is an open-source policy engine that evaluates declarative policies independently of the application or infrastructure being governed.

Compare how 2 books explain Open Policy Agent →

Related concepts

• Regouses · Rego is a declarative query and policy language for expressing rules over structured data, commonly evaluated by Open Policy Agent and related systems.
• policy enginekind of · A policy engine is a software component that evaluates policies against requests, resources, actions, or other inputs and produces decisions or enforcement outcomes.
• policy serviceused by · A policy service is a software service that receives evaluation requests, applies declared policies, and returns authorization or enforcement decisions.
• Gatekeeperused by · Gatekeeper is an open-source Kubernetes admission controller that validates and enforces policies using Open Policy Agent.
• service meshused by · A service mesh is an infrastructure layer that manages communication and cross-cutting concerns such as traffic control, security, and observability between distributed services.

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.