The cluster was down, and no one knew why. Logs were clean. Metrics looked fine. Access patterns? Chaos.
This is when you need policy to live where decisions happen. This is where Baa and Open Policy Agent (OPA) change the game. Baa — short for “Bring your own Authorization” — with OPA lets you enforce explicit, consistent, and testable rules across services without touching the core logic.
Open Policy Agent is a CNCF project built for decoupled policy enforcement. It runs alongside your services as a lightweight engine that evaluates rules written in Rego, its purpose-built policy language. With OPA, policies stay versionable, auditable, and readable. You stop scattering if-else statements. You start defining clear governance that runs anywhere: microservices, Kubernetes, APIs, CI/CD pipelines.
Baa applies OPA at the right layer: your application’s real decision points. Instead of pushing all access logic into OPA as an abstract idea, Baa approaches it like a living contract between apps and policies. Your services ask OPA for answers — “Can this user delete this resource?” OPA uses your rules to answer. That’s it. No opinion baked into the runtime. No surprise execution order. Just your logic, in your control.