OPA — policy as code for every AI platform decision.

TL;DR — Open Policy Agent lets you write rules in Rego and enforce them across Kubernetes, admission control, CI, APIs, and AI gateways. It turns policy from prose into executable logic.

What it is

OPA is an open-source policy engine. It evaluates Rego rules against JSON input and returns allow/deny plus structured decisions. In the AI Native landscape it sits in AI Native Infra › Governance, Policy and Security.

Why it exists

AI platforms need guardrails: who can deploy a model, which cluster can use what GPU class, what data can leave the boundary, and which model versions are approved. OPA centralizes those decisions so the rules live in one place instead of being duplicated in controllers and scripts.

How it works

OPA evaluates policy against input from an admission controller, API gateway, or CI pipeline. The caller asks a question, OPA returns a decision document. That pattern works well for model approval, registry access, tenant isolation, and prompt/filter rules.

Key features

• Rego language for expressive policy rules.
• Kubernetes admission via Gatekeeper or direct webhook integration.
• API and CI integration for non-Kubernetes policy checks.
• Portable across infra, app, and AI workflows.

Quick start

package ai.policy

default allow = false

allow {
  input.user.role == "ml-platform"
  input.resource.kind == "ModelDeployment"
}

When to use, when to skip

Use it when you need one policy language for the whole platform. Skip it if your rules are tiny and local, or if a domain tool like Kyverno is enough for Kubernetes-only checks.

vs / alongside

References

• OPA — project home.
• OPA docs — Rego and APIs.
• open-policy-agent/opa — source.

Verified against OPA docs, May 2026.