A realtime administration layer for Open Policy Agent (OPA) that pushes live policy and data updates to authorization agents.
OPAL (Open Policy Administration Layer) is a realtime administration layer for Open Policy Agent (OPA) that detects changes to policy and policy data and pushes live updates to agents. It ensures authorization layers stay synchronized with application state changes from APIs, databases, git, and third-party services, enabling fine-grained, up-to-date access control for modern distributed applications.
Developers and platform engineers building or managing authorization for modern, distributed, multi-tenant applications that require realtime, fine-grained access control. It is specifically for teams using or considering Open Policy Agent (OPA) who need to keep policies and data dynamically updated.
Developers choose OPAL because it supercharges OPA to meet the speed of live applications by providing realtime updates via a WebSocket Pub/Sub channel, eliminating the challenge of keeping policy agents manually synchronized. Its unique selling point is the decoupled, stateless, and extensible architecture that allows independent management of policy (via git) and data (from multiple distributed sources).
Fork of https://github.com/permitio/opal
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses WebSocket Pub/Sub to deliver instant updates to policy and data, ensuring authorization layers stay synchronized with application state changes from APIs, databases, and third-party services.
Designed to scale horizontally with no state retention, relying on edge caches and external data sources, making it suitable for cloud-native and microservices architectures.
Built with typed Python3, FastAPI, and Pydantic, allowing easy customization and integration of new data sources via custom fetch providers, as documented in the HOW-TOs.
Manages policy independently via git repositories and aggregates data from multiple distributed sources, enabling fine-grained, up-to-date access control without tight coupling.
Primarily tied to Open Policy Agent, inheriting its performance constraints for large datasets; the README admits it's not meant for >100GB data in one layer and may require sharding or workarounds.
Requires configuring WebSocket connections, git webhooks, data source integrations, and managing both server and client instances, which can be intricate and time-consuming compared to simpler solutions.
Focuses only on policy and data updates; developers must build or integrate additional components for user management, audit logs, and control interfaces, as noted in the 'What OPAL is not' section.