Tools/Open_Policy_Agent
Open Policy Agent (OPA)
CNCF policy-as-code engine for making fine-grained authorization decisions across services, APIs, and infrastructure. Paired with Keycloak (authentication) as the most-used open-source combination replicating IAM's authn+authz split — OPA handles the "is this action allowed" policy evaluation, Keycloak handles "who is this."