What is OPA used for?

OPA is an open source, general-purpose policy engine that decouples policy from application logic. It is a good fit for enforcing authorization policies in applications, managing shared policies across teams, and auditing and compliance with replayable decision history.

Yes. OPA is open source under the Apache-2.0 licence. Its source code is on GitHub at open-policy-agent/opa and is written mainly in Go.

Yes. OPA is open source, so the software itself is free to use.

Yes. OPA can be self-hosted on your own server or infrastructure.

What is OPA an alternative to?

OPA is an open-source alternative to Permit.io and Oso. Other open-source alternatives to Permit.io include SpiceDB, OpenFGA and Keto.

Is OPA actively maintained?

Yes. The most recent commit to OPA was on 13 October 2026, and the latest release is v1.21.2, published on 12 October 2026. The project has 12k stars on GitHub.

OPA: open-source alternative to Permit.io, Oso

About OPA

OPA is a policy engine that streamlines policy management across the stack for improved development, security and audit capability. It provides a high-level declarative language (Rego) that lets you specify policy for a wide range of use cases. You can use OPA to enforce policies in applications, proxies, Kubernetes, CI/CD pipelines, API gateways, and more.

OPA helps teams focus on delivering business value by decoupling policy from application logic. Security and platform teams centrally manage shared policies, while developer teams extend them as needed within the policy system. OPA generates comprehensive audit trails for every policy decision, supporting auditing and compliance efforts.

Key features

Decouples policy from application logic
Uses Rego, a domain-specific policy language built for speed
Operates on pre-loaded, in-memory data for fast policy decisions
Generates comprehensive audit trails for every policy decision
Supports integration via SDKs or REST API
Can enforce policies in applications, proxies, Kubernetes, CI/CD pipelines, API gateways, and more

Good fit for

Enforcing authorization policies in applications
Managing shared policies across teams
Auditing and compliance with replayable decision history

Built with: Go tools
Tags: policy engine; rego; kubernetes; authorization; compliance; open source

OPA: questions and answers

What is OPA used for?: OPA is an open source, general-purpose policy engine that decouples policy from application logic. It is a good fit for enforcing authorization policies in applications, managing shared policies across teams, and auditing and compliance with replayable decision history.
Is OPA open source?: Yes. OPA is open source under the Apache-2.0 licence. Its source code is on GitHub at open-policy-agent/opa and is written mainly in Go.
Is OPA free?: Yes. OPA is open source, so the software itself is free to use.
Can I self-host OPA?: Yes. OPA can be self-hosted on your own server or infrastructure.
What is OPA an alternative to?: OPA is an open-source alternative to Permit.io and Oso. Other open-source alternatives to Permit.io include SpiceDB, OpenFGA and Keto.
Is OPA actively maintained?: Yes. The most recent commit to OPA was on 13 October 2026, and the latest release is v1.21.2, published on 12 October 2026. The project has 12k stars on GitHub.