Core Capabilities
Policy as Arbiter
OPA evaluates Rego rules over policy data and request context. Policy defines precedence when multiple data sources conflict.
Single Access Plane
Employees, contractors, federated users, and agents — all through one model. Resource types span resource servers so policy targets types, not silos.
Agent-Safe Access
Agent clients get time-bound, scope-constrained tokens. Policy can apply JIT scoping, reduced TTL, and provider trust tiers — no privilege escalation.
Context-Aware
Beyond static attributes: time, location, risk score, MFA, transaction amount. Step-up, constrain, or deny at authorize, token, and introspect.
Standards-Based
OAuth 2.0, OIDC, DCR, RFC 8707 (resource indicators), RFC 9396 (RAR). You own the rules, not the lock-in.
How It Works
Your policies are OPA Rego. Your data is JSON. If you leave, everything comes with you.
Who Benefits
For CISOs / CSOs
- Control without code — Change policy; decisions reflect immediately.
- One place to govern — Single policy plane across first-party and third-party apps.
- Agent-safe access — Policy-driven scope and TTL constraints; no privilege escalation.
- Zero-trust ready — Context (MFA, location, risk) drives allow/deny/step-up at every phase.
For Platform & Integration Teams
- Days, not quarters — Add new resource types and policies without rewriting integrations.
- Ecosystem outcomes — Define "calendar" or "document" once; policy applies across vendors.
- Least privilege — Restrict clients by type, RS, or specific resource.
For App & Product Owners
- Delegation with guardrails — Users delegate to agents with time-bound scope; RS enforces via introspect.
- Obligations — PDP returns audit_level, data_masking, rate_limit; RS enforces.
- Standards-based — OAuth 2.0, OIDC, DCR, RFC 8707, RFC 9396. You own the rules.