Technology · Agentic → IAM · Open Source · wiki:deep
Open Policy Agent
Open Policy Agent (OPA) is a CNCF-graduated, general-purpose policy engine for unified, context-aware policy enforcement across the stack. You author policies in Rego; services query OPA when they need decisions (API authz, admission control, infra tags, …) instead of hardcoding rules. Integrate via Go SDK/API, REST, WASM, and ecosystem adapters (Kubernetes Gatekeeper, Terraform, Docker authz, SSH, …). Apache-2.0.
Why it matters here
Agent and platform gates need a shared policy brain outside each agent’s prompt. OPA is the research default for declarative Rego decisions that many services can query. Prefer Cedar when you want Amazon’s authorization-language focus; prefer Keycloak for identity/SSO; prefer Earned Autonomy Protocol for how autonomy scope is earned over time.
How it works
Policies and data live with OPA (sidecar, library, or central service). On each decision point the service queries OPA; OPA evaluates Rego against input + data and returns a result the service enforces.
- Write Rego rules for the decision question.
- Deploy OPA (CLI, container, embedded).
- Service queries OPA with request context.
- Service enforces allow/deny (or richer structured answers).
Related: cedar · earned-autonomy-protocol · keycloak · topics/13-governance-policy
Scroll inside the canvas to pan
When to reach for it
- Use when: you need stack-wide policy-as-code (authz, admission, infra) with Rego and CNCF ecosystem.
- Skip when: you primarily need IdP/users (keycloak), Cedar-style app authz language only, or governance methodology without an engine (earned-autonomy-protocol).
- Prefer instead: Gatekeeper for K8s admission specifically; Cedar for analyzable app permissions.
Limits
- Rego learning curve: wrong policies fail closed or open — review like code.
- Decision ≠ enforcement: callers must honor OPA answers.
- Not an IdP: identity still comes from Keycloak/OIDC/etc.
- Not the ledger: policy decisions support gates; they are not company SoR.
Linked from
Catalog backlinks — what points here (wiki “what links here”).
Features
- access-vs-authority
- agent-identity-interoperability
- autonomy-levels
- exception-first-participation
- governance
- job-finance
- job-healthcare
- job-insurance
- job-legal
- job-security
- live-work-portals
- open-source
- r2-13-governance-policy
- r2-ecosystem-synthesis
- r2-master-synthesis
- security-identity-governance
- wt-human-policy
- wt-master-synthesis
- wt-reuse-deploy-govern
Stacks
Peers
Document management
What we checked
Claims below are backed by science sources on disk.
Engine / Rego role
open-policy-agent/opa · MODERATE
“Open Policy Agent (OPA) is an open source, general-purpose policy engine.”
Docs / integration
OPA documentation · MODERATE
“OPA is a policy engine that streamlines policy management across your stack for improved development, security and audit capability.”
Contrast vs Keycloak
Keycloak contrast · MODERATE
“Open Source Identity and Access Management For Modern Applications and Services”
In this research stack
Features and peers linked from the catalog map — not a second product surface.
Features it supports
- access-vs-authority
- agent-identity-interoperability
- autonomy-levels
- exception-first-participation
- governance
- job-finance
- job-healthcare
- job-insurance
- job-legal
- job-security
- live-work-portals
- open-source
- r2-13-governance-policy
- r2-ecosystem-synthesis
- r2-master-synthesis
- security-identity-governance
- wt-human-policy
- wt-master-synthesis
- wt-reuse-deploy-govern
Same cell
Stack
Document management
- affinda
- candice-ai
- docplace
- docsum
- docsumo
- docsynecx
- document-one
- docusafe
- docuville
- docuware
- dokken
- doxsuite
- egnyte
- eigenpal
- eldoc
- eondocs
- extend
- hyperscience
- instabase
- klearstack
- kodori
- korto
- laserfiche
- m-files
- mindee
- mps-docs
- nectain
- nurie
- paperoffice
- parsewise
- reducto
- revver
- rossum
- unsiloed-ai
- vertesia
Source
Primary repo github.com/open-policy-agent/opa · Open Source
technologies/open-policy-agent/README.md
Research inventory
9 tags · 57 out · 59 in · 3 artifacts · 0 gaps · 44 corpus docs
Catalog tags
- landscape.layer
- Agentic
- landscape.subcategory
- IAM
- license_tag
- Open Source
- maps.dm
- present
- maps.features
- 19
- one_liner
- Agentic
- review.depth
- science
- slug
- open-policy-agent
- title
- Open Policy Agent
Artifacts
- dm_map · present · technologies/open-policy-agent/document-management.md
- features_map · present · technologies/open-policy-agent/features.md
- readme · present · technologies/open-policy-agent/README.md
Out · alternative_to
- cedartechnology
- earned-autonomy-protocoltechnology
- keycloaktechnology
Out · dm_axis
- affindadm_vendor · dm_vendor
- candice-aidm_vendor · dm_vendor
- docplacedm_vendor · dm_vendor
- docsumdm_vendor · dm_vendor
- docsumodm_vendor · dm_vendor
- docsynecxdm_vendor · dm_vendor
- document-onedm_vendor · dm_vendor
- docusafedm_vendor · dm_vendor
- docuvilledm_vendor · dm_vendor
- docuwaredm_vendor · dm_vendor
- dokkendm_vendor · dm_vendor
- doxsuitedm_vendor · dm_vendor
- egnytedm_vendor · dm_vendor
- eigenpaldm_vendor · dm_vendor
- eldocdm_vendor · dm_vendor
- eondocsdm_vendor · dm_vendor
- extenddm_vendor · dm_vendor
- hypersciencedm_vendor · dm_vendor
- instabasedm_vendor · dm_vendor
- klearstackdm_vendor · dm_vendor
- kodoridm_vendor · dm_vendor
- kortodm_vendor · dm_vendor
- laserfichedm_vendor · dm_vendor
- m-filesdm_vendor · dm_vendor
- mindeedm_vendor · dm_vendor
- mps-docsdm_vendor · dm_vendor
- nectaindm_vendor · dm_vendor
- nuriedm_vendor · dm_vendor
- paperofficedm_vendor · dm_vendor
- parsewisedm_vendor · dm_vendor
- reductodm_vendor · dm_vendor
- revverdm_vendor · dm_vendor
- rossumdm_vendor · dm_vendor
- unsiloed-aidm_vendor · dm_vendor
- vertesiadm_vendor · dm_vendor
Out · maps_to
- access-vs-authorityfeature
- agent-identity-interoperabilityfeature
- autonomy-levelsfeature
- exception-first-participationfeature
- governancefeature
- job-financefeature
- job-healthcarefeature
- job-insurancefeature
- job-legalfeature
- job-securityfeature
- live-work-portalsfeature
- open-sourcefeature
- r2-13-governance-policyfeature
- r2-ecosystem-synthesisfeature
- r2-master-synthesisfeature
- security-identity-governancefeature
- wt-human-policyfeature
- wt-master-synthesisfeature
- wt-reuse-deploy-governfeature
In · alternative_to
- cedartechnology
- earned-autonomy-protocoltechnology
- keycloaktechnology
In · dm_axis
- affindadm_vendor · technology
- candice-aidm_vendor · technology
- docplacedm_vendor · technology
- docsumdm_vendor · technology
- docsumodm_vendor · technology
- docsynecxdm_vendor · technology
- document-onedm_vendor · technology
- docusafedm_vendor · technology
- docuvilledm_vendor · technology
- docuwaredm_vendor · technology
- dokkendm_vendor · technology
- doxsuitedm_vendor · technology
- egnytedm_vendor · technology
- eigenpaldm_vendor · technology
- eldocdm_vendor · technology
- eondocsdm_vendor · technology
- extenddm_vendor · technology
- hypersciencedm_vendor · technology
- instabasedm_vendor · technology
- klearstackdm_vendor · technology
- kodoridm_vendor · technology
- kortodm_vendor · technology
- laserfichedm_vendor · technology
- m-filesdm_vendor · technology
- mindeedm_vendor · technology
- mps-docsdm_vendor · technology
- nectaindm_vendor · technology
- nuriedm_vendor · technology
- paperofficedm_vendor · technology
- parsewisedm_vendor · technology
- reductodm_vendor · technology
- revverdm_vendor · technology
- rossumdm_vendor · technology
- unsiloed-aidm_vendor · technology
- vertesiadm_vendor · technology
In · in_stack
- agentic-iamstack · alternative_slot
- durable-gated-executionstack · supporting
In · maps_to
- access-vs-authorityfeature
- agent-identity-interoperabilityfeature
- autonomy-levelsfeature
- exception-first-participationfeature
- governancefeature
- job-financefeature
- job-healthcarefeature
- job-insurancefeature
- job-legalfeature
- job-securityfeature
- live-work-portalsfeature
- open-sourcefeature
- r2-13-governance-policyfeature
- r2-ecosystem-synthesisfeature
- r2-master-synthesisfeature
- security-identity-governancefeature
- wt-human-policyfeature
- wt-master-synthesisfeature
- wt-reuse-deploy-governfeature
Corpus tags
- category
- Agentic → IAM
- dedication
- open-source
- feature
- access-vs-authorityagent-identity-interoperabilityautonomy-levelsexception-first-participationgovernancejob-financejob-healthcarejob-insurancejob-legaljob-securitylive-work-portalsopen-sourcer2-13-governance-policyr2-ecosystem-synthesisr2-master-synthesissecurity-identity-governancewt-human-policywt-master-synthesiswt-reuse-deploy-govern
- kind
- map_edgetech_featurestech_quotetech_readmetech_science_sourcetech_section
- needs_deepen
- false
- quality
- ok
- section
- Document management mapEvidenceFeatures mapGitHub mapHow it worksLimits & failure modesLinksScientific notesWhat it isWhen to use / skipWhy it matters here
- slug
- open-policy-agent
- source_id
- keycloak-contrastopa-docsopa-github
- technology
- open-policy-agent
Corpus documents (44)
map_edge · 19
- open-policy-agent → access-vs-authority
- open-policy-agent → agent-identity-interoperability
- open-policy-agent → autonomy-levels
- open-policy-agent → exception-first-participation
- open-policy-agent → governance
- open-policy-agent → job-finance
- open-policy-agent → job-healthcare
- open-policy-agent → job-insurance
- … +11 more
tech_features · 1
- Open Policy Agent · features
tech_quote · 9
- Open Policy Agent · keycloak-contrast
- Open Policy Agent · keycloak-contrast
- Open Policy Agent · keycloak-contrast
- Open Policy Agent · opa-docs
- Open Policy Agent · opa-docs
- Open Policy Agent · opa-docs
- Open Policy Agent · opa-github
- Open Policy Agent · opa-github
- … +1 more
tech_readme · 1
- Open Policy Agent
tech_science_source · 3
- Open Policy Agent · keycloak-contrast
- Open Policy Agent · opa-docs
- Open Policy Agent · opa-github
tech_section · 11
- Open Policy Agent · Document management map
- Open Policy Agent · Evidence
- Open Policy Agent · Features map
- Open Policy Agent · GitHub map
- Open Policy Agent · How it works
- Open Policy Agent · Limits & failure modes
- Open Policy Agent · Links
- Open Policy Agent · Scientific notes
- … +3 more