# Open Policy Agent Open Policy Agent is a general-purpose policy engine that unifies policy enforcement across applications, proxies, Kubernetes, CI/CD pipelines, and API gateways. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How to attach an owner to every cloud resource you find DevFeed: [How to attach an owner to every cloud resource you find]() Original publisher: [Read original article]() Author: Zeen Rachidi Published: 2026-09-15T14:00:00Z Content type: tutorial Language: en Sources: [The New Stack]() Topics: [Cloud](), [Provisioning](), [Open Policy Agent](), [audit trail]() Tags: [audit-trail](), [cloud](), [cloud-services](), [devops](), [env-zero](), [how-to](), [logs](), [open-policy-agent](), [platform-engineering](), [policy](), [post-contributed](), [provisioning](), [sponsor-env-zero](), [sponsored-post-contributed]() ### AI overview This tutorial explains how to identify cloud resources without assigned owners and prevent new ownerless resources. It presents continuously synced inventory queries, Open Policy Agent policies requiring owner tags, and logs or audit trails for resource governance. ### Source excerpt The engineer who knew why that cloud instance existed has left the company. The instance is still running, the bill The post How to attach an owner to every cloud resource you find appeared first on The New Stack. ## Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next DevFeed: [Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next]() Original publisher: [Read original article]() Author: Abhijit Pujare Eric Minick Published: 2026-09-11T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [policy-as-code](), [Open Policy Agent](), [rego](), [Kyverno](), [Software Engineering](), [Kubernetes](), [JSON](), [YAML](), [AI Agent]() Tags: [ai-agent](), [compliance](), [json](), [kyverno](), [opa](), [open-policy-agent](), [policies](), [policy-as-code](), [rego](), [security](), [software-engineering](), [yaml]() ### AI overview This article surveys the 2026 Policy as Code ecosystem, comparing general-purpose Open Policy Agent and Rego with specialized approaches such as Kyverno, Cedar, and agent-oriented governance. It discusses the shift toward automated, machine-readable governance, the separation of policy from business logic, and the challenges of authoring and maintaining Rego as schemas evolve. ### Source excerpt | Blog ## Optimizing OPA performance: From arrays to objects DevFeed: [Optimizing OPA performance: From arrays to objects]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-07T14:25:30Z Content type: tutorial Language: en Sources: [Capital One Tech]() Topics: [opa](), [Open Policy Agent](), [rego](), [Data structures](), [Optimization](), [Algorithms, Complexity]() Tags: [algorithms](), [cloud-native](), [data-structures](), [kubernetes](), [opa](), [open-policy-agent](), [optimization](), [performance-tuning](), [rego](), [software-development](), [software-engineering](), [software-supply-chain]() ### AI overview This article explains how to improve Open Policy Agent performance by choosing appropriate data structures for Rego policies. It focuses on replacing nested arrays with keyed objects to avoid inefficient array traversal when evaluating large datasets. ### Source excerpt Achieve 99% faster Rego policy execution through optimization. Note: This post focuses on one aspect of performance tuning Rego policies and datasets evaluated by OPA-arrays vs. objects. The Rego Style Guide and Regal Rego linter are very helpful resources for learning Rego best practices and avoiding code smells in Rego policies. There is also the OPA performance tuning documentation. In 2018, I started using open policy agent (OPA) as a solution for controlling and preventing unwanted behaviors in our Kubernetes Clusters. OPA, along with Kubernetes Dynamic Admission Control, provided a means to build preventive controls. Since then, I have worked with several PaC solutions. I have always stayed close to the OPA tool set because of how well it supports multiple use cases. OPA is domain agnostic and can be used with virtually any use case, as long as you supply the correct data and policies. To that end, OPA use cases have expanded throughout several technical disciplines, such as cloud-native computing and software supply chain management. OPA performance engineering OPA enables us to unify PaC solutions across multiple use cases and systems, using the same languages and tools. However, there is always room for improvement and performance engineering policies and the execution thereof. In addition, optimizing data that policies evaluate and mutate should be part of our focus when we deliver OPA-based solutions. Recently I was asked to help with OPA performance issues. I made several recommendations, but I overlooked one simple and glaring issue: the poor performing policy was processing a large data set using nested-arrays, instead of the best practice of using keyed-objects. Later, something was bothering me about my interaction and I realized that while I gave decent architectural level advice, I completely missed the best engineering advice. Rego policies and data should be optimized just like other algorithms and relative data, and part of that optimization is ## Secure DevSecOps: Evaluating OPA Policies Local to Your Data DevFeed: [Secure DevSecOps: Evaluating OPA Policies Local to Your Data]() Original publisher: [Read original article]() Author: Abhijit Pujare Rishabh Gupta Published: 2026-06-09T00:00:00Z Content type: release Language: en Sources: [Harness Blog]() Topics: [Open Policy Agent](), [DevSecOps](), [Security](), [Kubernetes]() Tags: [devsecops](), [firewalls](), [harness](), [open-policy-agent](), [security](), [shift-left]() ### AI overview Harness announces local evaluation of Open Policy Agent policies on Kubernetes infrastructure. The capability is intended to let policies access internal systems and keep API tokens, certificates, and passwords within corporate security and data-residency boundaries. ### Source excerpt Harness solves the firewall dilemma for OPA. Shift-left governance-as-code while keeping API tokens and internal systems secure within your local perimeter. | Blog ## Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD DevFeed: [Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD]() Original publisher: [Read original article]() Author: info@goteleport.com (Mohamed Ouad, Doyensec) Published: 2025-06-04T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [benchmarking](), [Authorization](), [Security](), [rego](), [Open Policy Agent](), [Vulnerabilities]() Tags: [authorization](), [benchmarking](), [opa](), [open-policy-agent](), [performance](), [rego](), [security](), [vulnerabilities]() ### AI overview This article introduces the Security Policy Evaluation Framework (SPEF), an automated testing and benchmarking system for evaluating authorization policy engines. It describes how SPEF assesses robustness, correctness, and performance across Rego, Cedar, OpenFGA, and Teleport ACD. ### Source excerpt Explore how the Security Policy Evaluation Framework (SPEF) benchmarks Rego, Cedar, OpenFGA, and Teleport ACD for vulnerabilities, correctness, and performance. ## Kube-Policies: Guardrails for Apps Running in Kubernetes DevFeed: [Kube-Policies: Guardrails for Apps Running in Kubernetes]() Original publisher: [Read original article]() Author: Hardik Darji Published: 2025-01-28T08:00:00Z Content type: article Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Kubernetes](), [cloud security](), [Open Policy Agent](), [Testing](), [SIEM, Security, Observability]() Tags: [admission-controller](), [engineering](), [kubernetes](), [observability](), [open-policy-agent](), [security](), [security-policies](), [testing]() ### AI overview This article introduces Square's design considerations for security guardrails in Kubernetes environments. It explains why default Kubernetes configurations can leave applications vulnerable and describes requirements for an abstraction layer built on Open Policy Agent, including policy dry-runs, minimal user disruption, testing, exception management, extensibility, and observability. ### Source excerpt Design considerations for highly sensitive environments. ## Ep. 8: Enhancing Go Application Security with JWT and OPA DevFeed: [Ep. 8: Enhancing Go Application Security with JWT and OPA]() Original publisher: [Read original article]() Published: 2024-07-02T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Go Language](), [Security](), [JSON Web Tokens](), [Open Policy Agent](), [Authentication](), [Authorization](), [Application Security]() Tags: [access-control-policies-go](), [advanced-go-security-tools](), [application-security](), [authentication](), [authentication-vs-authorization](), [authorization](), [comprehensive-security-framework-go](), [dynamic-authorization-rules](), [embedding-opa-scripts-go](), [external-service-opa](), [flexible-authorization-go](), [go](), [go-application-security](), [go-application-security-guide](), [go-authentication](), [go-authorization](), [go-developer-security](), [go-security-best-practices](), [go-security-frameworks](), [go-token-expiration-management](), [implementing-jwt-go](), [jwt](), [jwt-private-key-signing](), [jwt-token-generation](), [jwt-validation-go](), [opa](), [opa-go-tutorial](), [open-policy-agent-go](), [public-key-verification-jwt-go](), [reliable-authentication-go](), [robust-go-authentication](), [scalable-security-go](), [secure-go-applications](), [secure-token-management](), [security](), [updating-access-control-policies-go](), [verifying-user-identity-go]() ### AI overview This episode explains authentication and authorization for Go applications, including JWT generation, signing, validation, and expiration management. It also introduces Open Policy Agent for managing dynamic authorization rules separately from application code. ### Source excerpt Introduction: In this segment, Bill delves into the fundamental aspects of authentication and authorization, equipping Go developers with essential knowledge and advanced tools to enhance the security of their applications. Through practical examples and detailed explanations, he unpacks the intricacies of these concepts, demonstrating their crucial role in protecting and managing access to your software systems. Learn the distinct roles of verifying user identity and determining access levels. Discover how to use JWTs for secure token generation, validation, and expiration management. ## Automatic source locations with Rego DevFeed: [Automatic source locations with Rego]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt Published: 2024-02-12T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [opa](), [snyk-iac](), [Infrastructure as code](), [Open Policy Agent](), [AWS CloudFormation](), [Terraform]() Tags: [blog](), [blog-post](), [cloud-security](), [cloudformation](), [developer](), [devops](), [engineering](), [iac](), [opa](), [rego](), [snyk](), [snyk-iac](), [technical]() ### AI overview This technical Snyk article explains automatic source code locations for Rego policy violations in Snyk IaC. The feature reports accurate file, line, and column information, including for custom rules. A simplified proof of concept uses CloudFormation YAML, Rego policies, and YAML tree traversal to infer attribute paths and retrieve source locations. ### Source excerpt We recently released a series of improvements to Snyk IaC, and in this blog post, we're taking a technical dive into a particularly interesting feature -- automatic source code locations for rule violations. ## Open Policy Agent for Trino arrived DevFeed: [Open Policy Agent for Trino arrived]() Original publisher: [Read original article]() Author: Manfred Moser Published: 2024-02-06T00:00:00Z Content type: article Language: en Sources: [Trino Blog]() Topics: [Open Policy Agent](), [Authorization](), [Cloud Native Ecosystem](), [Open Source](), [Pull Request](), [Code review](), [migration]() Tags: [access-control](), [cloud-native](), [migration](), [opa](), [open-source](), [policy](), [pull-request](), [review]() ### AI overview Trino 438 introduces an access control integration with Open Policy Agent (OPA). The article recounts the collaboration that brought the integration to Trino, its presentation at Trino Summit 2023, migration from Apache Ranger, and demonstrations of OPA across data platforms. ### Source excerpt Trino now ships with an access control integration using the popular and widely used Open Policy Agent (OPA) from the Cloud Native Computing Foundation. The release of Trino 438 marks an important milestone of the effort towards this integration. ## Rego 103: Types of values and rules DevFeed: [Rego 103: Types of values and rules]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-16T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Programming]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [iac-security](), [infrastructure-as-code](), [learn](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac](), [types]() ### AI overview This beginner-focused article is the third part of a Rego introduction series. It explains scalar and composite value types, including strings, numbers, booleans, null, arrays, objects, and sets, and introduces set rules, object rules, functions, and iteration for writing policies evaluated by OPA. ### Source excerpt Learn about the different types of Values and Rules you can use to build policies in OPA & Rego. ## Rego 101: Introduction to Rego DevFeed: [Rego 101: Introduction to Rego]() Original publisher: [Read original article]() Author: Becki Lee Published: 2023-11-02T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Security](), [Programming]() Tags: [blog](), [blog-post](), [cloud-security](), [developer](), [devrel](), [enablement](), [how-to](), [iac-security](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [learn](), [opa](), [policy](), [rego](), [security](), [snyk-cloud](), [snyk-iac](), [tutorial]() ### AI overview A beginner-focused introduction to Rego, the declarative policy language used with Open Policy Agent (OPA). It explains policy as code, how OPA evaluates Rego policies, and how these policies can be applied to cloud and infrastructure-as-code resources. ### Source excerpt Learn how to write your first policy as code rules in Rego. This Rego tutorial for beginners covers the basics of Rego syntax and using OPA. ## Enforcing Policies with Gatekeeper in Kubernetes DevFeed: [Enforcing Policies with Gatekeeper in Kubernetes]() Original publisher: [Read original article]() Author: Cameron Wood, Elieser Pereira, Rodrigo Martinez Published: 2022-06-30T13:34:38Z Content type: tutorial Language: en Sources: [Blog - Container Solutions]() Topics: [Kubernetes](), [Security](), [Open Policy Agent](), [Authorization]() Tags: [best-practices](), [how-to](), [kubernetes](), [open-policy-agent](), [open-source](), [policy](), [security](), [security-policies](), [wtf-is-cloud-native]() ### AI overview This tutorial explains how Gatekeeper works with Kubernetes RBAC to enforce authorization rules and pod security policies. It presents Gatekeeper, based on Open Policy Agent, as a way to add deny rules, protect namespaces, and replace deprecated Pod Security Policies. ### Source excerpt When managing Kubernetes clusters, cluster administrators need to ensure the overall stability of the system. To accomplish this it is necessary to avoid disruptions to the control plane, and also avoid any risks of users being able to escalate their privileges thus causing further problems. With this in mind, protecting the kube-system namespace and enforcing pod security policies to run payloads with just the necessary access is a must.