Styra / Open Policy Agent

Overview

Open Policy Agent (OPA) is a CNCF graduated, Apache 2.0 general-purpose policy engine that uses the Rego language, and Styra is the company that created OPA and sells Styra DAS, a commercial management control plane. Together they are the de facto standard for policy-as-code across cloud-native infrastructure. OPA decides "is this allowed?" for almost anything, from Kubernetes admission to API authorization, making it broader than application-focused tools like Cerbos and the Zanzibar engines OpenFGA and AuthZed.

What it is good at

Reach is the strength: one engine and one language enforce policy across Kubernetes admission control, microservice authorization, API gateways, Terraform plans, and CI/CD pipelines. OPA is battle-tested, widely adopted, and deployable anywhere as a sidecar or library, which is why its deployment flexibility scores high. Styra DAS layers on policy distribution, impact analysis, audit, and a UI for teams that need governance at scale. For platform teams that want a single, standardized policy substrate across infrastructure and services, nothing else has the same breadth or adoption.

Where it falls short

Rego has a real learning curve and is not purpose-built for application object permissions the way ReBAC engines are, so app-centric authorization (per-document sharing, ownership hierarchies) can feel low-level and verbose. For a single application, a general-purpose policy engine is often more than you need. Styra DAS pricing is enterprise and quote-based, not transparent, and like all policy engines OPA does nothing for authentication, SSO, or MFA.

Pricing

OPA is free and open source under Apache 2.0. Styra DAS has a free tier and paid enterprise plans with quote-based pricing for the commercial control plane and support. Model the build-versus-buy tradeoff with the TCO calculator.

Best for, and who should look elsewhere

Choose OPA when you need policy-as-code spanning infrastructure and services, and add Styra DAS for governance at enterprise scale. For application-centric authorization, compare Styra/OPA vs Cerbos; for relationship-heavy permissions look at OpenFGA or AuthZed. See the authorization guide.

Bottom line

The standard for cloud-native policy-as-code spanning infrastructure and services; add Styra DAS when you need governance and management at enterprise scale.