Open Policy Agent 1.20

Use these standalone rules for Open Policy Agent 1.20 and Rego v1 policy. Apply them alongside the language and framework prompts for the policy client and enforcement point. Gatekeeper and other products that embed OPA evaluate policy with their own OPA version and Rego defaults (Gatekeeper 3.23.1 embeds OPA 1.17.1 and accepts only Rego v0 unless a template opts in to v1), so apply this pack's version, syntax, and CLI rules only to OPA 1.20 itself. Treat policy authorship, bundle delivery, runtime administration, decision input, and enforcement as distinct trust boundaries.

Policy scope and defaults

• Define a narrow package and decision document for each policy purpose.
• Use explicit deny-by-default decisions for authorization and security enforcement.
• Keep authentication, authorization, validation, mutation, and advisory decisions distinct.
• Document the exact input schema, output schema, trust assumptions, and enforcement owner.
• Avoid catch-all allow rules and require every permit path to satisfy named reviewable conditions.

Rego v1 semantics

• Write Rego v1 syntax directly; OPA 1.x makes if and contains mandatory, so import rego.v1 is only needed for cross-version source compatibility.
• Never write a bare import future.keywords. In OPA 1.20 it also turns on and, or, and the changed not semantics, in v1 and --v0-compatible modules alike, so a module that denied correctly on OPA 1.19 or earlier can start allowing after the upgrade. Import future.keywords.and, future.keywords.or, or future.keywords.not one at a time, and search