Every app needs rules. Who can delete a record? Which containers are allowed to run? Can this Terraform plan deploy a public S3 bucket? Without OPA, those rules live scattered across application code and config files with no central audit trail. This OPA (Open Policy Agent) tutorial shows you how to centralise all of that into one place using policy as code. By the end, you will have OPA installed, a Rego policy written, and a clear picture of where it fits in a real system. <\/p>\n\n\n\n
OPA (Open Policy Agent) is a free, open-source policy engine that separates the question “is this allowed?” from the application code that enforces the answer.<\/p>\n\n\n\n
Your application sends a JSON input to OPA, such as the user’s role and the action they want to perform. OPA evaluates that input against your Rego policies and returns a decision, typically allow: true<\/strong> or allow: false<\/strong>. Your application enforces it. OPA only decides, never enforces. This means you update policies without touching application code, test them independently, and audit every decision from one place.<\/p>\n\n\n\n Policy as code sits at the intersection of DevOps, security, and platform engineering, one of the highest-growth skill clusters in 2026. HCL GUVI’s DevOps Course<\/a> covers CI\/CD, infrastructure automation, and security integration with real-world projects and NSDC certification.<\/p>\n\n\n\n OPA ships as a single binary with no runtime dependencies.<\/p>\n\n\n\n Confirm it worked by running opa version<\/strong>, which prints the current version number.<\/p>\n\n\n\n Rego (pronounced “ray-go”) is OPA’s policy language. It is declarative, meaning you describe what should be true, not how to compute it.<\/p>\n\n\n\n Three things to know before writing your first policy:<\/p>\n\n\n\n That last point is important. OPA follows a closed-world assumption: if you have not explicitly allowed something, it is denied. You opt into permission, never out of it.<\/p>\n\n\n\n Create a file called policy.rego<\/strong> with the following content:<\/p>\n\n\n\n This policy does one thing. It denies everything by default, then allows the request only if the user’s role is “admin.” Simple, readable, and completely separate from any application code.<\/p>\n\n\n\n Now create an input file called input.json<\/strong>:<\/p>\n\n\n\n This is the core of any OPA (Open Policy Agent) tutorial: actually running a policy evaluation.<\/p>\n\n\n\n Run this command in your terminal:<\/p>\n\n\n\n opa eval -d policy.rego -i input.json “data.authz.allow”<\/strong><\/p>\n\n\n\n OPA returns:<\/p>\n\n\n\n The value is true<\/strong> because the input user has the role “admin.” Change the role to “viewer” and run it again. The result becomes false<\/strong> immediately, with no code change needed anywhere else in your system.<\/p>\n\n\n\n For real applications, OPA runs as a REST API server your services query over HTTP.<\/p>\n\n\n\n Start it with: opa run –server policy.rego<\/strong><\/p>\n\n\n\n OPA listens on port 8181. Query it with:<\/p>\n\n\n\n curl -X POST http:\/\/localhost:8181\/v1\/data\/authz\/allow –data ‘{“input”: {“user”: {“role”: “admin”}, “action”: “delete”}}’<\/strong><\/p>\n\n\n\n OPA responds with {“result”: true}<\/strong>. Your application reads the result and enforces it. Policy logic lives entirely in Rego. Application code stays clean.<\/p>\n\n\n\n This OPA (Open Policy Agent) tutorial walks you through the full beginner workflow: installing OPA, understanding how Rego works, writing a real policy, evaluating it against input, and running OPA as a server your applications can query. The core shift OPA enables is simple but powerful: policy logic moves out of scattered application code and into one testable, auditable, version-controlled place.<\/p>\n\n\n\n Yes. OPA is fully open-source under Apache 2.0. Everything in this OPA (Open Policy Agent) tutorial requires no paid account.<\/p>\n\n<\/div>\n<\/div>\n Rego (pronounced “ray-go”), a declarative language built specifically for expressing policy logic over JSON data.<\/p>\n\n<\/div>\n<\/div>\n No. OPA works with any system that sends JSON over HTTP, including API authorization, Terraform validation, and CI\/CD pipeline checks.<\/p>\n\n<\/div>\n<\/div>\n It is treated as undefined, which defaults to denied. Always set default allow := false<\/strong> explicitly and build conditions that make it true.<\/p>\n\n<\/div>\n<\/div>\n Yes. Use open-policy-agent\/setup-opa<\/strong> and run opa test<\/strong> on every pull request to catch policy regressions automatically.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n <\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Every app needs rules. Who can delete a record? Which containers are allowed to run? Can this Terraform plan deploy a public S3 bucket? Without OPA, those rules live scattered across application code and config files with no central audit trail. This OPA (Open Policy Agent) tutorial shows you how to centralise all of that […]<\/p>\n","protected":false},"author":65,"featured_media":120908,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[621],"tags":[],"views":"50","authorinfo":{"name":"Jebasta","url":"https:\/\/www.guvi.in\/blog\/author\/jebasta\/"},"thumbnailURL":"https:\/\/www.guvi.in\/blog\/wp-content\/uploads\/2026\/06\/OPA-Open-Policy-Agent-Tutorial-300x116.webp","_links":{"self":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119045"}],"collection":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/comments?post=119045"}],"version-history":[{"count":2,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119045\/revisions"}],"predecessor-version":[{"id":120919,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119045\/revisions\/120919"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media\/120908"}],"wp:attachment":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media?parent=119045"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/categories?post=119045"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/tags?post=119045"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}OPA (Open Policy Agent) Tutorial: Installation<\/strong><\/h2>\n\n\n\n
\n
Understanding Rego in 2 Minutes<\/strong><\/h2>\n\n\n\n
\n
Writing Your First Policy<\/strong><\/h2>\n\n\n\n
package authz\n\nimport rego.v1\n\ndefault allow := false\n\nallow if {\n input.user.role == \"admin\"\n}\n<\/code><\/pre>\n\n\n\n{\n \"user\": {\n \"name\": \"alice\",\n \"role\": \"admin\"\n },\n \"action\": \"delete\"\n}\n<\/code><\/pre>\n\n\n\nEvaluating a Policy with the CLI<\/strong><\/h2>\n\n\n\n
{\n \"result\": [\n {\n \"expressions\": [\n {\n \"value\": true,\n \"text\": \"data.authz.allow\"\n }\n ]\n }\n ]\n}\n<\/code><\/pre>\n\n\n\nRunning OPA as a Server<\/strong><\/h2>\n\n\n\n
Where OPA Fits in Your Stack<\/strong><\/h2>\n\n\n\n
Use Case<\/strong><\/td> What OPA Checks<\/strong><\/td><\/tr> API authorization<\/td> Can this user call this endpoint?<\/td><\/tr> Kubernetes admission<\/td> Does this pod spec meet security policies?<\/td><\/tr> Terraform validation<\/td> Does this plan violate compliance rules?<\/td><\/tr> CI\/CD<\/a> pipelines<\/td> Does this container image come from an approved registry?<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n \ud83d\udca1 Did You Know?<\/h3>\n
\n
Common Mistakes to Avoid<\/strong><\/h2>\n\n\n\n
\n
Conclusion<\/strong><\/h2>\n\n\n\n
FAQs<\/strong><\/h2>\n\n\n
1. Is OPA free to use?<\/strong><\/h3>\n
2. What language are OPA policies written in?<\/strong><\/h3>\n
3. Is OPA only for Kubernetes?<\/strong><\/h3>\n
4. What happens when OPA cannot evaluate a rule?<\/strong><\/h3>\n
5. Can I run OPA in GitHub Actions?<\/strong><\/h3>\n