Open Policy Agent (OPA) is a general-purpose policy engine that decouples policy decisions from application code. Policies are written in Rego — OPA's declarative query language — and evaluated by the OPA engine against structured input data (JSON). In DevSecOps, OPA evaluates Kubernetes manifests before deployment, Terraform plans before apply, and API requests before they reach microservices. The same policy engine serves all three contexts, reducing the policy surface area teams need to maintain.
Analogy🏏Cricket
🏏 Think of it like cricket: A batting coach who only reviews a batter's technique after a tournament has already ended. The batter has played 10 matches with a flawed grip — every run scored with bad technique is harder to unlearn than if the coach had corrected it in the first net session. Shifting security left is bringing the coach into the net sessions, not the post-tournament review.