Styra / Open Policy Agent

Status update: OPA's creators joined Apple

On 20 August 2025 the Open Policy Agent blog announced that OPA's creators, along with many Styra team members, had joined Apple. OPA stays a CNCF graduated project under Apache 2.0, with no change to governance or licensing. Styra's open repositories (Enterprise OPA, OPA Control Plane, SDKs, and the Regal linter) were put forward for inclusion in the CNCF OPA GitHub organization. Since then, the EOPA repository has been archived with a note that it "has been donated to the OPA community" and an open call for maintainers, while OPA Control Plane and Regal remain active in that organization. The announcement did not address Styra DAS or commercial support, and on 16 October 2026 the styra.com domain no longer resolved. Treat OPA as a community project and do not buy Styra DAS or Styra support without written terms.

Overview

Open Policy Agent (OPA) is a CNCF graduated, Apache 2.0 general-purpose policy engine that uses the Rego language. Styra, the company that created OPA, sold Styra DAS as a commercial management control plane. OPA is the de facto standard for policy-as-code across cloud-native infrastructure. OPA decides "is this allowed?" for almost anything, from Kubernetes admission to API authorization, making it broader than application-focused tools like Cerbos and the Zanzibar engines OpenFGA and AuthZed.

What it is good at

Reach is the strength: one engine and one language enforce policy across Kubernetes admission control, microservice authorization, API gateways, Terraform plans, and CI/CD pipelines. OPA is battle-tested, widely adopted, and deployable anywhere as a sidecar or library, which is why its deployment flexibility scores high. For policy distribution and management at scale, the open-source OPA Control Plane provides Git-based bundle building, external data sourcing, and bundle distribution to cloud object storage. Confirm it covers the governance features you used in Styra DAS before migrating. For platform teams that want a single, standardized policy substrate across infrastructure and services, nothing else has the same breadth or adoption.

Where it falls short

Rego has a real learning curve and is not purpose-built for application object permissions the way ReBAC engines are, so app-centric authorization (per-document sharing, ownership hierarchies) can feel low-level and verbose. For a single application, a general-purpose policy engine is often more than you need. There is no longer a clear vendor offering commercial support, so enterprises that need a support contract must rely on in-house expertise or a third party, and like all policy engines OPA does nothing for authentication, SSO, or MFA.

Pricing

OPA, OPA Control Plane, and Regal are free and open source under Apache 2.0. We found no current Styra price list or support offering after the August 2025 move to Apple, so budget for internal operation and support. Model the build-versus-buy tradeoff with the TCO calculator.

Best for, and who should look elsewhere

Choose OPA when you need policy-as-code spanning infrastructure and services and can operate it yourself, using OPA Control Plane for policy management. If you need a vendor-backed control plane with a support contract, look at commercial policy-as-code options such as Cerbos (Cerbos Hub). For application-centric authorization, compare Styra/OPA vs Cerbos; for relationship-heavy permissions look at OpenFGA or AuthZed. See the authorization guide.

Bottom line

Still the standard for cloud-native policy-as-code spanning infrastructure and services, now as a community project without its original commercial backer. Run it with OPA Control Plane, and do not buy Styra DAS or Styra support without written terms.