opa-policy

Centralize Navigator web route authorization decisions in Open Policy Agent.

Updated Aug 27, 2026

Search Tags:#authorization #middleware #policy #opa #rego #sidecar

Ready to run

npx skills add https://github.com/neon-law-foundation/navigator --skill opa-policy

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: opa-policy
Source: https://github.com/neon-law-foundation/navigator/tree/main/.claude/skills/opa-policy
Command: npx skills add https://github.com/neon-law-foundation/navigator --skill opa-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill removes scattered authorization logic by centralizing access-control decisions for Navigator web routes in Open Policy Agent.

Core Features & Use Cases

OPA as decision point: Keep authorization rules in Rego so policy can change without redeploying the application.
Navigator web enforcement: Use the middleware and sidecar pattern to protect portal routes and return 403 responses when access is denied.
Policy operations: Evaluate, test, format, and hot-reload bundled policies for safe development and production debugging.

Quick Start

Use this Skill to update Navigator authorization policy in OPA, verify the route rules, and keep enforcement fail-closed for protected web paths.

Frequently Asked Questions about opa-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How does centralizing authorization in OPA work for web routes?▼

Centralizing authorization in OPA moves access-control decisions for web routes into Rego policies, enforced via a middleware and sidecar pattern. This lets you update rules without redeploying the application.

How do I update Navigator authorization policy in OPA?▼

You update Navigator authorization policy by writing default-deny Rego rules, bundling them into a hot-reloadable ConfigMap, and verifying route enforcement through the OPA sidecar.

Does OPA middleware return a 403 when access is denied for protected portal routes?▼

Yes, OPA middleware returns 403 responses when access is denied for protected portal routes. The sidecar enforcement also operates with fail-closed behavior on transport errors to maintain security.

Can I hot-reload Rego policies in OPA without redeploying the application?▼

Yes, you can hot-reload Rego policies in OPA without redeploying by bundling policy updates into a ConfigMap. This allows policy changes to take effect immediately in production.

What happens to Navigator web enforcement when OPA encounters a transport error?▼

When OPA encounters a transport error, Navigator web enforcement defaults to fail-closed behavior, blocking access to protected routes rather than allowing unverified requests through.

Do I need default-deny rules when configuring OPA authorization for Navigator web routes?▼

Yes, default-deny rules are required when configuring OPA authorization for Navigator. This ensures all access requests are explicitly rejected unless a Rego policy rule grants permission.