Policy Engine
A policy engine is a system that evaluates access requests against defined rules and produces authorization decisions. It decouples policy logic from application code, allowing organizations to define, version, test, and audit their access rules independently of the systems that enforce them.
Why It Matters
The two dominant open-source policy engines are OPA (Open Policy Agent, CNCF graduated) with its Rego policy language, and Cedar (AWS open source). Both evaluate structured JSON inputs against boolean policy rules and return allow/deny decisions.
For agent governance, the policy engine is the decision-making core. When an MCP gateway intercepts a tool call, it assembles the context (user identity, agent identity, action type, target app, session history) and passes it to the policy engine. The engine evaluates the applicable policies and returns one of three outcomes: auto-approve, escalate, or deny.
Deterministic policy engines are preferred over AI-evaluating-AI approaches for agent governance. When an auditor asks "why was this action approved?", a deterministic policy produces a traceable chain of conditions. An AI-based evaluator produces a probability.