Open Policy Agent

My team is using OPA in a re-build of an application that we support. One of the main goals of the rebuild is to ensure we don't end up in a situation where every little rule change (including UAM changes) requires a full rebuild/deploy cycle of the app.

OPA replaces a complex hard-coded, and largely inscrutable UAM model with a (still complex), but flexibly defined, independently testable, and easily inspectable single-responsibility model.

I like that OPA has built in support for testing rulesets. The partial evaluation feature is amazing, ands makes it easy to apply UAM filters to endpoints that return large sets of data (we have consistent query APIs across the app, so could do this with a relatively simple OPA-aware proxy).

It's not all sunshine and roses, and the result might seem overly complex for a lot of use cases, but in our case I think OPA has provided a nice clean abstraction and enabled us to disentangle our UAM from the rest of our code and move more quickly overall.

Nice to see OPA making the front page! I'm a bit biased though, I used to work at Styra :o)

Used it during my last gig for policy enforcement on a multi-tenant platform for internal applications.

I found it relatively easy to use and at a good level of abstraction to make the policies relatively reusable.

OPA is much more wide ranging. You can use it for permissions, sure, but also just about anything else you can imagine. I think that makes it much more compelling as a technological investment.

I work in a highly regulated environment and evaluated using Cedar or OPA.

The biggest advantage to OPA was the flexibility. This enabled not just an authorization decision, but the why behind it. No more questions of why did this person/system gain (or was denied) access, combing through dozens of rules to find the matching statements. Just pull up the log and read the results… This is incredibly useful during audits.

Cedar could not provide that level of detail (or so I was told by AWS representatives selling their hosted version).