opa

I would like to put in an honourable mention for Open Policy Agent: https://github.com/open-policy-agent/opa

Policy-as-code is one of those things that everyone knows should be done, but in practice is rarely implemented. We believe this is caused by the combination of the following 2 factors: - OPA [1] and tools like cloud custodian [2] are cumbersome to set up, so writing even a single policy/ setting it up in your organisation takes a lot of effort. - Each policy project needs to start from scratch because policies aren't re-usable Infrabase checks your infra with an LLM instead of policies directly (currently a combination of gemini-2.5-pro-preview-05-06 and o4-mini). You can write your own policies as natural language [3] prompts to customize behaviour. This is still early: non-determinism and latency are open problems. But for most teams, “some guard-rails today” beats “perfect rego never”, and llm's are only getting better. We'd love your

Thanks for sharing Biscuit, I was collecting examples of authentication policy languages. Datalog is also the basis for Open Policy Agent https://www.openpolicyagent.org/docs/latest/ , more specifically it's Rego language which is also implemented in go https://github.com/open-policy-agent/opa/tree/main/rego

My list of most useful Terraform open-source tools: "Reverse"/creating from existing cloud resources: Terraformer: https://github.com/GoogleCloudPlatform/terraformer Aztfy (Azure only): https://github.com/Azure/aztfy Basic GitOps: Atlantis - https://www.runatlantis.io/ DRY wrapper: Terragrunt: https://github.com/gruntwork-io/terragrunt Policy as code: OPA: https://github.com/open-policy-agent/opa Static code analysis: checkov: https://github.com/bridgecrewio/checkov tfsec: https://github.com/aquasecurity/tfsec terrascan: https://github.com/tenable/terrascan kics: https://github.com/Checkmarx/kics Cost: Infracost (estimation): https://github.com/infracost/infracost Terratag (tagging): https://github.com/env0/terratag (disclaimer, I am CEO at env0) Documentation: terraform-docs: https://github.com/terraform-docs/terraform-docs Do you have o

The policy CLI builds upon the ideas and direction described in https://github.com/open-policy-agent/opa/issues/1413 (May 2019) and attempts to provide a concrete solution for a standard workflow for Policy As Code creation, publishing, sharing, and consumption.

From my limited research looking for authorization systems [1] it is but it is not: OPA can get actually quite slow for "real world" production scenarios. For example until recently Ory Keto used OPA and had that issue https://github.com/open-policy-agent/opa/issues/1443 . It seems to me that Oso although is based in Opa and Zanzibar ideas, it may have some performance improvements and ease of use. [1] (we are planning to change a half-assed internal auth system to a pre-existing one)

I’m unfamiliar with the oso architecture so this might not be how it works, but I’d be interested in particular in the performance with ‘large’ input objects (~5mb+ in JSON). They have a good page in their documentation here: https://www.openpolicyagent.org/docs/latest/policy-performan... which explains the loaded data is around 20x the input - we’ve had to work around this. Though we are using OPA for something which it’s not really designed for too... EDIT: I see this question below is answered here: https://news.ycombinator.com/item?id=25443354 Another question would be around how one extends oso. For example, OPA supports custom built-ins: https://www.openpolicyagent.org/docs/latest/extensions/. The other option is to add functionality to the language itself, e.g. https://github.com/open-policy-agent/opa/pull/2538 Oso seems to support

See also https://github.com/open-policy-agent/opa (lower-level building-block) and https://github.com/ory/keto (built on OPA)

There's also Open Policy Agent (OPA) https://github.com/open-policy-agent/opa

If you want a Go implementation, look at OPA https://github.com/open-policy-agent/opa - designed for authorization but quite general.