# opa Published articles for opa. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next DevFeed: [Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next]() Original publisher: [Read original article]() Author: Abhijit Pujare Eric Minick Published: 2026-09-11T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [policy-as-code](), [Open Policy Agent](), [rego](), [Kyverno](), [Software Engineering](), [Kubernetes](), [JSON](), [YAML](), [AI Agent]() Tags: [ai-agent](), [compliance](), [json](), [kyverno](), [opa](), [open-policy-agent](), [policies](), [policy-as-code](), [rego](), [security](), [software-engineering](), [yaml]() ### AI overview This article surveys the 2026 Policy as Code ecosystem, comparing general-purpose Open Policy Agent and Rego with specialized approaches such as Kyverno, Cedar, and agent-oriented governance. It discusses the shift toward automated, machine-readable governance, the separation of policy from business logic, and the challenges of authoring and maintaining Rego as schemas evolve. ### Source excerpt | Blog ## Q2 2026 Product Update: Harness Pipeline DevFeed: [Q2 2026 Product Update: Harness Pipeline]() Original publisher: [Read original article]() Author: Vishal Vishwaroop Published: 2026-08-06T00:00:00Z Content type: release Language: en Sources: [Harness Blog]() Topics: [ci](), [Git](), [opa](), [configuration](), [Developer experience](), [Monitoring](), [API]() Tags: [2026](), [api](), [ci](), [developer-experience](), [git](), [opa](), [pipeline](), [pipelines](), [update]() ### AI overview Harness's Q2 2026 Pipeline update introduces beta DAG pipelines, allowing stages to declare explicit dependencies. It also adds looping strategies for chained pipelines, earlier matrix exclusions, template and governance improvements, Git-backed entity enforcement, execution visibility, and a pipeline dry-run API. ### Source excerpt DAG pipelines, template overrides, OPA enforcement on Git-backed entities, Git Experience monitoring, and 20 pipeline improvements -- Q2 2026 in review. | Blog ## Automated DevOps Compliance with Harness Rego Policy Packs DevFeed: [Automated DevOps Compliance with Harness Rego Policy Packs]() Original publisher: [Read original article]() Author: Abhijit Pujare Vishal Vishwaroop Published: 2026-07-14T00:00:00Z Content type: release Language: en Sources: [Harness Blog]() Topics: [DevOps](), [rego](), [sdlc](), [opa](), [Security]() Tags: [audit](), [compliance](), [devops](), [governance](), [opa](), [policy](), [policy-as-code](), [rego](), [sdlc]() ### AI overview Harness announces Policy Packs, a curated library of pre-written Rego policies that helps teams align software delivery lifecycles with compliance frameworks. The packs provide out-of-the-box governance controls covering frameworks including SOC 2, NIST, PCI DSS, HIPAA, and HITRUST. ### Source excerpt Shift governance left with out-of-the-box Policy-as-Code. Simplify compliance and achieve continuous audit readiness across your entire SDLC. | Blog ## Optimizing OPA performance: From arrays to objects DevFeed: [Optimizing OPA performance: From arrays to objects]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-07T14:25:30Z Content type: tutorial Language: en Sources: [Capital One Tech]() Topics: [opa](), [Open Policy Agent](), [rego](), [Data structures](), [Optimization](), [Algorithms, Complexity]() Tags: [algorithms](), [cloud-native](), [data-structures](), [kubernetes](), [opa](), [open-policy-agent](), [optimization](), [performance-tuning](), [rego](), [software-development](), [software-engineering](), [software-supply-chain]() ### AI overview This article explains how to improve Open Policy Agent performance by choosing appropriate data structures for Rego policies. It focuses on replacing nested arrays with keyed objects to avoid inefficient array traversal when evaluating large datasets. ### Source excerpt Achieve 99% faster Rego policy execution through optimization. Note: This post focuses on one aspect of performance tuning Rego policies and datasets evaluated by OPA-arrays vs. objects. The Rego Style Guide and Regal Rego linter are very helpful resources for learning Rego best practices and avoiding code smells in Rego policies. There is also the OPA performance tuning documentation. In 2018, I started using open policy agent (OPA) as a solution for controlling and preventing unwanted behaviors in our Kubernetes Clusters. OPA, along with Kubernetes Dynamic Admission Control, provided a means to build preventive controls. Since then, I have worked with several PaC solutions. I have always stayed close to the OPA tool set because of how well it supports multiple use cases. OPA is domain agnostic and can be used with virtually any use case, as long as you supply the correct data and policies. To that end, OPA use cases have expanded throughout several technical disciplines, such as cloud-native computing and software supply chain management. OPA performance engineering OPA enables us to unify PaC solutions across multiple use cases and systems, using the same languages and tools. However, there is always room for improvement and performance engineering policies and the execution thereof. In addition, optimizing data that policies evaluate and mutate should be part of our focus when we deliver OPA-based solutions. Recently I was asked to help with OPA performance issues. I made several recommendations, but I overlooked one simple and glaring issue: the poor performing policy was processing a large data set using nested-arrays, instead of the best practice of using keyed-objects. Later, something was bothering me about my interaction and I realized that while I gave decent architectural level advice, I completely missed the best engineering advice. Rego policies and data should be optimized just like other algorithms and relative data, and part of that optimization is ## Type Level Security: The future of secure AI code generation? DevFeed: [Type Level Security: The future of secure AI code generation?]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-06-04T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [AI-assisted coding](), [Vulnerabilities](), [Rust](), [Python](), [Web](), [Document Object Model (DOM)](), [Application Services]() Tags: [ai](), [application-security](), [awareness](), [blog](), [code-generation](), [code-security](), [developer](), [devops](), [devsecops](), [enablement](), [external](), [opa](), [python](), [rust](), [security](), [snyk-code](), [snyk-platform](), [tools](), [types](), [vulnerabilities](), [web]() ### AI overview The article argues that type systems and secure-by-design libraries can make many web application security vulnerabilities impossible to write or catch at compile time. It presents this approach as a way to reduce vulnerabilities in manually written and AI-generated code, with examples involving Rust, Python, and Trusted Types. ### Source excerpt Secure-by-design types can turn common bugs into compile-time errors. This post explores how type-level security could help prevent entire classes of AI-generated vulnerabilities. ## Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD DevFeed: [Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD]() Original publisher: [Read original article]() Author: info@goteleport.com (Mohamed Ouad, Doyensec) Published: 2025-06-04T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [benchmarking](), [Authorization](), [Security](), [rego](), [Open Policy Agent](), [Vulnerabilities]() Tags: [authorization](), [benchmarking](), [opa](), [open-policy-agent](), [performance](), [rego](), [security](), [vulnerabilities]() ### AI overview This article introduces the Security Policy Evaluation Framework (SPEF), an automated testing and benchmarking system for evaluating authorization policy engines. It describes how SPEF assesses robustness, correctness, and performance across Rego, Cedar, OpenFGA, and Teleport ACD. ### Source excerpt Explore how the Security Policy Evaluation Framework (SPEF) benchmarks Rego, Cedar, OpenFGA, and Teleport ACD for vulnerabilities, correctness, and performance. ## Ep. 8: Enhancing Go Application Security with JWT and OPA DevFeed: [Ep. 8: Enhancing Go Application Security with JWT and OPA]() Original publisher: [Read original article]() Published: 2024-07-02T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Go Language](), [Security](), [JSON Web Tokens](), [Open Policy Agent](), [Authentication](), [Authorization](), [Application Security]() Tags: [access-control-policies-go](), [advanced-go-security-tools](), [application-security](), [authentication](), [authentication-vs-authorization](), [authorization](), [comprehensive-security-framework-go](), [dynamic-authorization-rules](), [embedding-opa-scripts-go](), [external-service-opa](), [flexible-authorization-go](), [go](), [go-application-security](), [go-application-security-guide](), [go-authentication](), [go-authorization](), [go-developer-security](), [go-security-best-practices](), [go-security-frameworks](), [go-token-expiration-management](), [implementing-jwt-go](), [jwt](), [jwt-private-key-signing](), [jwt-token-generation](), [jwt-validation-go](), [opa](), [opa-go-tutorial](), [open-policy-agent-go](), [public-key-verification-jwt-go](), [reliable-authentication-go](), [robust-go-authentication](), [scalable-security-go](), [secure-go-applications](), [secure-token-management](), [security](), [updating-access-control-policies-go](), [verifying-user-identity-go]() ### AI overview This episode explains authentication and authorization for Go applications, including JWT generation, signing, validation, and expiration management. It also introduces Open Policy Agent for managing dynamic authorization rules separately from application code. ### Source excerpt Introduction: In this segment, Bill delves into the fundamental aspects of authentication and authorization, equipping Go developers with essential knowledge and advanced tools to enhance the security of their applications. Through practical examples and detailed explanations, he unpacks the intricacies of these concepts, demonstrating their crucial role in protecting and managing access to your software systems. Learn the distinct roles of verifying user identity and determining access levels. Discover how to use JWTs for secure token generation, validation, and expiration management. ## Keycloak DevDay 2024 Videos published DevFeed: [Keycloak DevDay 2024 Videos published]() Original publisher: [Read original article]() Author: Niko Köbler Published: 2024-06-14T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [IAM](), [Multi-tenancy](), [opa](), [Apache Cassandra](), [Extension](), [Testcontainers]() Tags: [cassandra](), [community](), [conference](), [event](), [extension](), [idm](), [kerberos](), [keycloak](), [ldap](), [multi-tenancy](), [opa](), [openid-connect](), [saml](), [sso](), [testcontainers](), [videos]() ### AI overview This announcement says that recorded and live-streamed sessions from the first Keycloak DevDay conference were published online. It lists sessions covering Keycloak, including multi-tenancy, access management with OPA, extension development, Testcontainers, IAM, configuration, and Cassandra. ### Source excerpt Back in February this year, we (Sebastian and me (Niko)) hosted the very first edition of Keycloak DevDay - a one-day, community-driven conference - in Frankfurt/Main, Germany. The event was a blast and completely sold-out, plus many additional participants online in the two parallel live streams. We were able to welcome attendees from all over Europe. Thank you all for being part of this incredible event! 🙏 For all of you who couldn't attend, we have published all the recorded and live streamed sessions online on my YouTube channel: Keynote: What's Next in Keycloak (Alexander Schwartz, Red Hat) Multi-Tenancy in Keycloak (Garth Patil, Phase Two) Flexible Access Management with Keycloak & OPA (Thomas Darimont, codecentric) Best Practices for Extension Development (Sven-Torben Janus, Conciso) Extensions Development with Testcontainers (Niko Köbler, @dasniko) A Look at Keycloak from the IAM Point of View (Robert Bauer, intension) Automating Keycloak Configuration (Sophie Tauchert, Relaxdays) Ask the Maintainers Session (A. Schwartz, T. Darimont, S. Schuster) IAM Doomsday Prepper (Maik Kingma) Keycloak Cassandra Datastore (Dominik Schlosser) The complete playlist can be found here. We are currently preparing the next edition "Keycloak DeveloperDay 2025". If you want to contribute, please get in touch with us (Sebastian & Niko)! Expect more information in the next weeks and months. Looking forward to have you and your colleagues & team members as attendees! ## Automatic source locations with Rego DevFeed: [Automatic source locations with Rego]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt Published: 2024-02-12T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [opa](), [snyk-iac](), [Infrastructure as code](), [Open Policy Agent](), [AWS CloudFormation](), [Terraform]() Tags: [blog](), [blog-post](), [cloud-security](), [cloudformation](), [developer](), [devops](), [engineering](), [iac](), [opa](), [rego](), [snyk](), [snyk-iac](), [technical]() ### AI overview This technical Snyk article explains automatic source code locations for Rego policy violations in Snyk IaC. The feature reports accurate file, line, and column information, including for custom rules. A simplified proof of concept uses CloudFormation YAML, Rego policies, and YAML tree traversal to infer attribute paths and retrieve source locations. ### Source excerpt We recently released a series of improvements to Snyk IaC, and in this blog post, we're taking a technical dive into a particularly interesting feature -- automatic source code locations for rule violations. ## Open Policy Agent for Trino arrived DevFeed: [Open Policy Agent for Trino arrived]() Original publisher: [Read original article]() Author: Manfred Moser Published: 2024-02-06T00:00:00Z Content type: article Language: en Sources: [Trino Blog]() Topics: [Open Policy Agent](), [Authorization](), [Cloud Native Ecosystem](), [Open Source](), [Pull Request](), [Code review](), [migration]() Tags: [access-control](), [cloud-native](), [migration](), [opa](), [open-source](), [policy](), [pull-request](), [review]() ### AI overview Trino 438 introduces an access control integration with Open Policy Agent (OPA). The article recounts the collaboration that brought the integration to Trino, its presentation at Trino Summit 2023, migration from Apache Ranger, and demonstrations of OPA across data platforms. ### Source excerpt Trino now ships with an access control integration using the popular and widely used Open Policy Agent (OPA) from the Cloud Native Computing Foundation. The release of Trino 438 marks an important milestone of the effort towards this integration. ## Centrally enforce policy as code for GraphQL APIs DevFeed: [Centrally enforce policy as code for GraphQL APIs]() Original publisher: [Read original article]() Author: Vivek Ravishankar Published: 2023-12-12T14:00:00Z Content type: article Language: en Sources: [Apollo Blog]() Topics: [GraphQL](), [policy-as-code](), [Authorization](), [GraphOS](), [API Platform](), [Open Policy Agent]() Tags: [announcement](), [api-platform](), [authorization](), [developer](), [developers](), [graphos](), [graphql](), [opa](), [policy-as-code]() ### AI overview Apollo describes using GraphOS schema directives to enforce policy-as-code authorization at the type and field levels of federated GraphQL supergraphs. The directives are generally available to GraphOS Enterprise customers and can integrate with authorization systems such as Open Policy Agent. ### Source excerpt Although many in the industry consider GraphQL a replacement for existing API technologies, it is at its most powerful when used as a central orchestration layer between apps and existing services. This layer, implemented as a federated graph (or supergraph, for short), acts as a self-service API platform that accelerates development velocity for both frontend and backend teams. ## Rego 103: Types of values and rules DevFeed: [Rego 103: Types of values and rules]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-16T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Programming]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [iac-security](), [infrastructure-as-code](), [learn](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac](), [types]() ### AI overview This beginner-focused article is the third part of a Rego introduction series. It explains scalar and composite value types, including strings, numbers, booleans, null, arrays, objects, and sets, and introduces set rules, object rules, functions, and iteration for writing policies evaluated by OPA. ### Source excerpt Learn about the different types of Values and Rules you can use to build policies in OPA & Rego. ## Rego 102: Combining queries with AND/OR and custom messages DevFeed: [Rego 102: Combining queries with AND/OR and custom messages]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-09T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Programming](), [Cloud](), [Infrastructure as code](), [JSON](), [YAML]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [guide](), [how-to](), [iac-security](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac]() ### AI overview A beginner-focused guide to intermediate Rego syntax, explaining how to combine queries with AND and OR and introduce custom messages. It describes how OPA evaluates Rego policies against JSON or YAML input documents. ### Source excerpt Learn how to use AND and OR rules and custom messages using OPA and Rego in the second part of our beginner's guide to Rego. ## Rego 101: Introduction to Rego DevFeed: [Rego 101: Introduction to Rego]() Original publisher: [Read original article]() Author: Becki Lee Published: 2023-11-02T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Security](), [Programming]() Tags: [blog](), [blog-post](), [cloud-security](), [developer](), [devrel](), [enablement](), [how-to](), [iac-security](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [learn](), [opa](), [policy](), [rego](), [security](), [snyk-cloud](), [snyk-iac](), [tutorial]() ### AI overview A beginner-focused introduction to Rego, the declarative policy language used with Open Policy Agent (OPA). It explains policy as code, how OPA evaluates Rego policies, and how these policies can be applied to cloud and infrastructure-as-code resources. ### Source excerpt Learn how to write your first policy as code rules in Rego. This Rego tutorial for beginners covers the basics of Rego syntax and using OPA. ## CVE-2019-3826 as a false positive in OPA Gatekeeper Images DevFeed: [CVE-2019-3826 as a false positive in OPA Gatekeeper Images]() Original publisher: [Read original article]() Published: 2023-10-31T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [Vulnerabilities](), [Prometheus](), [opa](), [GitHub]() Tags: [analysis](), [chainguard](), [chainguard-images](), [cve](), [cve-2019-3826](), [cves](), [deployment](), [false-positive](), [opa](), [prometheus](), [security](), [vulnerabilities](), [vulnerability](), [vulnerability-scanner]() ### AI overview This article explains that CVE-2019-3826 affects applications using Prometheus for metrics when they expose the web UI. It presents the Chainguard OPA Gatekeeper Image as unaffected because it does not expose that UI, making the scanner result a false positive. ### Source excerpt Unveil the false positive of CVE-2019-3826 and combat phantom menaces with Chainguard's vigilant security.