Open Policy Agent

OPA Control Plane (OCP) is a centralized management system for OPA deployments. It simplifies policy management by providing:

• Git-based Policy Management: Build bundles from Rego in multiple Git repositories and use Git for environment promotion.
• External Datasources: Fetch and bundle external data at build-time using HTTP push and pull mechanisms.
• Scalable Bundle Serving: Distribute bundles to cloud object storage (AWS S3, Google Cloud Storage, Azure Blob Storage) for reliable delivery to OPA instances.
• Global and Hierarchical Policies: Inject organization-wide rules into bundles at build-time using label selectors, with support for custom conflict resolution logic written in Rego.

OPA MCP is a Model Context Protocol (MCP) server designed to provide MCP-compatible clients (such as Claude Desktop, Cursor, VS Code, Zed, and Windsurf) with a structured interface for authoring, debugging, and testing Rego policies.

Instead of relying on free-form CLI text, it exposes over 50 tools with stable error codes and schema-validated input/output. It wraps the following core components:

• OPA CLI: opa fmt, opa check, opa eval, opa test, opa build, and opa sign.
• OPA REST API
• Regal linter
• Conftest

It also provides higher-level helpers specifically designed for AI agents to perform complex tasks like explaining decisions or suggesting fixes.

The opa-nats plugin is a Go-based extension for Open Policy Agent that replaces or augments OPA's runtime store. It uses a NATS Key-Value store as the backend, allowing OPA policies to access externally managed data. To optimize performance, the plugin implements an LRU (Least Recently Used) cache that stays in sync with the NATS Key-Value store.

There are two primary ways to use this plugin:

1. Custom OPA Binary: Use a pre-built OPA binary that has the plugin pre-registered.
2. Go Library Integration: Embed the plugin into your own Go-based OPA builds using the provided library.

This plugin is particularly useful for the data layer when you need to provide external data to policies via specific paths that are managed outside of the standard OPA data loading process.

https://github.com/permitio/opa-nats

Open Policy Agent (OPA) is an open-source, general-purpose policy engine designed to unify policy enforcement across your entire stack. It allows you to decouple policy decision-making from policy enforcement by providing a high-level declarative language (Rego) and simple APIs.

When your software needs to make a decision, it queries OPA and provides structured data (typically JSON) as input. OPA then evaluates this input against your defined policies and data to generate a decision, which can be a simple boolean (allow/deny) or any arbitrary structured data.

The OPA REST API is a primary method for integrating with Open Policy Agent. The API is organized into several functional groups:

• Policy API: Used to manage policies loaded into the OPA instance.
• Data API: Used to evaluate rules and retrieve data.
• Query API: Used to execute ad hoc queries.
• Compile API: Provides access to Rego's Partial Evaluation and data filtering functionality.
• Health API: Provides access to instance operational health information.
• Config API: Allows viewing the instance configuration.
• Status API: Allows viewing the instance status state.

Note: If you are integrating from a programming language, using one of the official language SDKs may be easier than interacting with the REST API directly.

The OPA-Envoy plugin is an extension of Open Policy Agent (OPA) that adds a gRPC server implementing the Envoy External Authorization API.

It allows you to enforce fine-grained, context-aware access control policies at the proxy level (Envoy) without needing to modify your underlying microservices. It is designed to work with Envoy (v1.7.0+) using its External Authorization filter.

Topaz is an open-source authorization service that provides fine-grained, real-time, policy-based access control for applications and APIs. It uses Open Policy Agent (OPA) as its core decision engine.

Key features include:

• Decision Engine: Powered by OPA.
• Data Model: Includes an embedded database for storing subjects, relations, and objects, inspired by the Google Zanzibar model.
• Deployment: Can be deployed as a sidecar or a microservice in cloud environments.

Open Policy Containers (OPCR) provides a Docker-inspired workflow for managing OPA policies. It allows you to treat OPA policies as OCIv2 container images, enabling you to use standard container registry workflows to build, tag, sign, push, and pull policies.

Key capabilities include:

• Policy Distribution: Use a container registry to distribute policies and data.
• Bundle API Integration: OPCR policy images can be loaded via the OPA Bundle API.
• Discovery Bundles: Images can contain discovery bundles for automated loading.
• External Data Distribution: You can package and distribute data alongside policies by building and pushing OCI images.
• Go Integration: Uses the open-policy-agent/opa/repl package to interact with OPA instances.

OPToggles is a solution designed to synchronize open-policy decisions from OPA and OPAL to your frontend using feature flag providers. It enables the creation of user-targeted feature flags derived directly from the policy rules defined in OPA. By leveraging OPAL's real-time change detection for both policies and policy-data, OPToggles ensures that user-targeted flags are updated in real-time.

Key integrations include:

• LaunchDarkly: Native support for feature flag management.
• Generic REST API: Support for custom feature flag implementations via a REST interface.

For more information, visit the OPToggles GitHub repository or explore the demo tutorials.