Open Policy Agent (OPA)

OPA separates policy decisions from enforcement: the calling system supplies structured input, and OPA evaluates it against policies written in Rego. The official documentation lists CI/CD pipelines among its use cases and demonstrates evaluating infrastructure policy. For an illustrative infrastructure check, a pipeline can pass the structured representation of a proposed change to OPA, evaluate a rule such as rejecting an exposed insecure protocol, then fail the job when the decision indicates a violation. The pipeline must supply the input and enforce the result; OPA is a policy engine, not a CI runner. No policy or pipeline was executed for this entry.

You can explore the interactive examples in the official docs or install the CLI and use opa eval for local evaluation. The docs also describe running OPA as an HTTP service or embedding it as a Go library. Teams need to write and maintain Rego policies and decide how policy outcomes affect their deployment workflow. The OPA project is licensed under Apache 2.0; no separate hosted-service or commercial support pricing is claimed.