I was left with the somewhat opposite feeling. I still don’t know what OPA actually is or does. It has a nice paragraph describing it without saying anything at all.
- How do I enforce that inbound API requests come only from trusted sources?
- How do I enforce fine-grained access to user records?
- How do I enforce a set of naming conventions for a data update?
Many such policies may come from regulatory requirements, may be regional in nature, and may change in otherwise stable codebases. And it's even harder when you're applying this to a highly-scalable production internet service. As a result, defining policy at an organizational level with auditing is a challenge for large enterprises. OPA helps enterprises administer and enforce policies.
More details on what OPA does here: https://www.openpolicyagent.org/docs/philosophy
And you can see some examples of Rego (the policy language) here: https://play.openpolicyagent.org
It's as though you're describing a car to someone who's never seen a car before by listing all the places you can go in a car.
Use their library in your application to evaluate policies.
Run it from the cli.
Embed it in some service like nginx.
The language itself is pretty focused on some prolog-ish describing of what constitutes an allow/deny decision.
Looking again, I see your point. If you don’t know what it is having the acronym spelled out doesn’t help much at all.
Still it clears the low bar provided by those announcements that just say something like:
“BEOTZ’s developers are joining Flmp.io. As well all know BEOTZ is popular and Flmp.io is a top provider to enterprises. We look forward to exciting things coming soon.”