Open Policy Agent 1.21

Apply these rules to standalone OPA services, Rego policies, and their enforcement integrations. When embedding OPA as a Go library, also apply the Go prompt for the application's Go release line; the standalone binary needs no Go installation. Products that embed OPA, such as Gatekeeper, evaluate policy with their own OPA version and Rego defaults, so apply this pack's version, syntax, and CLI rules only where OPA 1.21 itself evaluates the policy.

Decisions and trusted input

• Define authorization decisions with default allow := false and explicit positive grants.
• Require the expected decision type and an explicit allow at the enforcement point; deny on undefined results, malformed replies, evaluation errors, timeouts, and unavailable OPA. A successful Data API HTTP status with no result is not permission.
• Build input from authenticated server context; claims, headers, and labels supplied by a caller remain untrusted until verified.
• Document the input/output contract, trusted data sources, and enforcement owner for each decision. Reject unknown or ambiguous input schema versions.
• Canonicalize identifiers, paths, hosts, methods, actions, and resource names using the same rules as the system executing the operation before comparing them.
• Validate types, required fields, sizes, tenant, action, and resource identifiers before evaluation; never let a request replace trusted roles, ownership, or tenant data.
• Check object access for the exact operation that will execute, including tenant boundaries and every requested object.
• Model service accounts,