# styra-opa Source: https://startwithidentity.com/vendors/authorization/styra-opa/ Last updated: 2026-10-16 License: content by Start with Identity. Cite the source URL. --- ## Status update: OPA's creators joined Apple On 20 August 2025 the [Open Policy Agent blog](https://www.openpolicyagent.org/blog/note-from-teemu-tim-and-torin-to-the-open-policy-agent-community-2dbbfe494371) announced that OPA's creators, along with many Styra team members, had joined Apple. OPA stays a CNCF graduated project under Apache 2.0, with no change to governance or licensing. Styra's open repositories (Enterprise OPA, OPA Control Plane, SDKs, and the Regal linter) were put forward for inclusion in the CNCF OPA GitHub organization. Since then, the [EOPA repository](https://github.com/open-policy-agent/eopa) has been archived with a note that it "has been donated to the OPA community" and an open call for maintainers, while [OPA Control Plane](https://github.com/open-policy-agent/opa-control-plane) and [Regal](https://github.com/open-policy-agent/regal) remain active in that organization. The announcement did not address Styra DAS or commercial support, and on 16 October 2026 the styra.com domain no longer resolved. Treat OPA as a community project and do not buy Styra DAS or Styra support without written terms. ## Overview Open Policy Agent (OPA) is a CNCF graduated, Apache 2.0 general-purpose policy engine that uses the Rego language. Styra, the company that created OPA, sold Styra DAS as a commercial management control plane. OPA is the de facto standard for policy-as-code across cloud-native infrastructure. OPA decides "is this allowed?" for almost anything, from Kubernetes admission to API authorization, making it broader than application-focused tools like [Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/) and the Zanzibar engines [OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/) and [AuthZed](https://startwithidentity.com/vendors/authorization/authzed/). ## What it is good at Reach is the strength: one engine and one language enforce policy across Kubernetes admission control, microservice authorization, API gateways, Terraform plans, and CI/CD pipelines. OPA is battle-tested, widely adopted, and deployable anywhere as a sidecar or library, which is why its deployment flexibility scores high. For policy distribution and management at scale, the open-source [OPA Control Plane](https://github.com/open-policy-agent/opa-control-plane) provides Git-based bundle building, external data sourcing, and bundle distribution to cloud object storage. Confirm it covers the governance features you used in Styra DAS before migrating. For platform teams that want a single, standardized policy substrate across infrastructure and services, nothing else has the same breadth or adoption. ## Where it falls short Rego has a real learning curve and is not purpose-built for application object permissions the way ReBAC engines are, so app-centric authorization (per-document sharing, ownership hierarchies) can feel low-level and verbose. For a single application, a general-purpose policy engine is often more than you need. There is no longer a clear vendor offering commercial support, so enterprises that need a support contract must rely on in-house expertise or a third party, and like all policy engines OPA does nothing for authentication, SSO, or MFA. ## Pricing OPA, OPA Control Plane, and Regal are free and open source under Apache 2.0. We found no current Styra price list or support offering after the August 2025 move to Apple, so budget for internal operation and support. Model the build-versus-buy tradeoff with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/). ## Best for, and who should look elsewhere Choose OPA when you need policy-as-code spanning infrastructure and services and can operate it yourself, using OPA Control Plane for policy management. If you need a vendor-backed control plane with a support contract, look at commercial policy-as-code options such as [Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/) (Cerbos Hub). For application-centric authorization, compare [Styra/OPA vs Cerbos](https://startwithidentity.com/compare/styra-opa-vs-cerbos/); for relationship-heavy permissions look at [OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/) or [AuthZed](https://startwithidentity.com/vendors/authorization/authzed/). See the [authorization guide](https://startwithidentity.com/guides/authorization/). ## Bottom line Still the standard for cloud-native policy-as-code spanning infrastructure and services, now as a community project without its original commercial backer. Run it with OPA Control Plane, and do not buy Styra DAS or Styra support without written terms.