Skip to main content

OPA & Enterprise OPA Fundamentals

Overview​

The Open Policy Agent (OPA) is the general-purpose Policy Decision Point (PDP) at the center of most authorization stacks. You write policy in Rego, an enforcement point sends it an input document, and OPA returns a decision. This course teaches enough Rego to write and test a real policy, shows how policy and data ship together as a bundle, and explains where Enterprise OPA (EOPA) fits when a deployment outgrows plain OPA.

The course is vendor-neutral: everything in the lab is standard OPA that runs on the open-source opa binary. EnforceAuth's control plane, Writ, governs and deploys policies like these across OPA and Enterprise OPA PDPs, but Writ is not on the request path and is not required to complete this course.

Who this is for​

Open-source OPA users starting the Associate track: platform, security, and application engineers who need to read, write, and test Rego and to reason about how a policy is delivered to a PDP. It assumes you have completed the reference course and can read a default-deny policy.

Outcomes​

By the end of this course you will be able to:

  • Write Rego v1 rules, including a helper rule, the in operator, and a comprehension.
  • Drive an allow decision from data instead of hardcoded conditions.
  • Package policy and data as a bundle and explain how a PDP loads it.
  • Run and interpret an opa test suite, and write allow and deny tests.
  • Explain what Enterprise OPA adds over OPA: decision-log masking, delta bundles, live datasources, and scale, without confusing those features with the policy itself.

Lessons​

  1. Rego basics: rules, helpers, in, and comprehensions
  2. Bundles and testing with opa test
  3. OPA vs Enterprise OPA

Hands-on lab​

This course includes a graded lab in lab/. policy.rego ships as a starter: the data, method sets, subject_tier helper, and write_accounts comprehension are provided, and the two allow decision rules are left as a # TODO(learner) stub. You implement them until the allow-and-deny test suite passes. Wired into Lesson 1. Run it with:

git clone https://github.com/EnforceAuth/university-labs.git
cd university-labs
opa test courses/opa-eopa-fundamentals -v

The starter reports PASS: 3/6 until you write the two rules; the goal is PASS: 6/6.

Certification​

Counts toward the Associate track. Certification is a machine-graded practical: you author a policy that the assessment engine runs against a HIDDEN opa test suite you do not see. This lab is practice for that exam. The quiz in quiz.json checks the concepts.