Open Policy Agent (OPA) is the control layer that decides which keys fit which locks. When paired with granular database roles, it becomes a precise engine for authorization—fast, consistent, and verifiable. This combination lets you write policies once and enforce them everywhere, across SQL, NoSQL, and modern cloud-native stores.
Granular database roles split permissions along the smallest possible lines. Instead of broad, monolithic roles, each role is tailored to operations and data slices: row-level, column-level, schema-level. You can grant read-only access to a subset of columns in one table, while allowing full write access to another. OPA enforces these fine-grained boundaries by decoupling policy from the application code and storing it in a central, queryable format.
OPA uses Rego, a declarative language for writing authorization rules. With Rego, you map incoming queries or API calls to allowed actions based on the user's role, attributes, or context. The database becomes a passive responder—OPA evaluates the request before it ever reaches the data. In a microservices setup, OPA sits at the edge of your services, meaning permissions are checked uniformly regardless of the database type.