opal

Why we included this project

Keeping authorization rules and the data they depend on in sync with a running service is a real operational pain. OPAL acts as a distribution layer for policy engines like OPA and Cedar: it watches policy bundles and data sources such as git, databases, S3, or your own APIs, then pushes live updates to agents over a websocket pub/sub channel. Each agent subscribes only to the topics it needs, so the sync stays targeted instead of broadcasting everything everywhere. That makes it a good fit for microservices and teams doing policy-as-code, where access control should track live application state rather than requiring redeploys of static config. If you're building fine-grained authorization across many services, this is a practical layer worth a look.