{
  "id": "tool:opa",
  "_kind": "Tool",
  "_file": "domain/tools/tools-security-observability.yaml",
  "_cluster": "domain",
  "attributes": {
    "displayName": "Open Policy Agent",
    "homepageUrl": "https://www.openpolicyagent.org",
    "kind": "security",
    "description": "General-purpose policy engine that decouples policy decisions from application code using the\nRego language. Enforces fine-grained authorization policies across microservices, Kubernetes\nadmission control, API gateways, and CI/CD pipelines.\n"
  },
  "outgoingEdges": [
    {
      "from": "tool:opa",
      "to": "language:go",
      "kind": "belongs_to_language"
    },
    {
      "from": "tool:opa",
      "to": "skill-area:policy-enforcement",
      "kind": "tool_used_by",
      "attributes": {}
    },
    {
      "from": "tool:opa",
      "to": "skill-area:access-control",
      "kind": "tool_used_by",
      "attributes": {}
    },
    {
      "from": "tool:opa",
      "to": "tool:falco",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Runtime security — OPA enforces policies via Rego; Falco detects threats via eBPF"
      }
    }
  ],
  "incomingEdges": [
    {
      "from": "stack-profile:security-operations",
      "to": "tool:opa",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:ai-safety-guardrails",
      "to": "tool:opa",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:terraform-landing-zone",
      "to": "tool:opa",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:container-registry-scanning",
      "to": "tool:opa",
      "kind": "composed_of"
    },
    {
      "from": "tool:falco",
      "to": "tool:opa",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Runtime security — Falco detects threats via eBPF; OPA enforces policies via Rego"
      }
    },
    {
      "from": "tool-server:mcp-opa",
      "to": "tool:opa",
      "kind": "integrates_with",
      "attributes": {}
    }
  ]
}