#opa

Forbidden Configuration — Operationalizing Policy as Code to guard against...

The plugin looks enabled, the policy is correct, yet Docker allows everything. A silent security gap I hit with opa-docker-authz in production, and its lessons.

Most teams that run Terraform have had this meeting. Someone opened a pull request. The plan said 3...

Policy as code for AI agent tool authorization: why OPA or Cedar should decide every tool call, not the prompt. Real incidents, one hard lesson.

On OPA v1.20.2, semver.is_valid returns true for leading-zero versions (01.2.3, 1.02.3) and empty pre-release/build sections (1.2.3-, 1.2.3+), and semver.compare compares 1.02.3 and 1.2.3 as equal.

A practical guide to making your infrastructure pipeline the hardest thing to breach in your...

In bundle mode, a one-character .manifest key typo (rego_verison for rego_version) draws no diagnostic that names the key; the failure can surface as rego_parse_error pointing at your .rego — OPA v1.20.1

1. O Problema: Erros Que Só Aparecem Depois do Apply No artigo anterior desta série, vimos...

OPA Gatekeeper in Production: 18 Months, 47 Policies, Zero Bypass Incidents We adopted OPA...

Detection produces a number. Something has to turn that number into a response, and the response has...

Agent-to-agent traffic is going into production faster than the authorization models are catching up. We built and open-sourced a reference implementation that shows what chain-aware authorization looks like, using Open Policy Agent as the engine. MIT licensed, Go, single binary.

AI agents are nothing but APIs on cron with autonomy and reasoning. Everything we learned about API authorization still applies. Here is the pattern I think should become standard, and the reason it works.