OPA / Rego
Open Policy Agent (OPA) is a CNCF-graduated policy engine that decouples policy decision-making from application logic. Rego is OPA's purpose-built policy language: a declarative language where policies are boolean rules evaluated against structured JSON inputs.
Why It Matters
OPA evaluates policies expressed in Rego against JSON data and returns structured decisions. This separation of policy from code means organizations can define, version, test, and audit access rules without modifying application code.
In agent governance, OPA/Rego policies evaluate every tool call against conditions like action type, user properties, app sensitivity, and session context. The visual rule builders that some products offer are presentation layers on top of Rego: the underlying logic is deterministic and auditable.
OPA was selected over Cedar by several agent governance vendors (including Cakewalk) for its maturity, community size, and Kubernetes ecosystem integration. Cedar offers a simpler syntax but a smaller ecosystem.