OPA Policies for AI: Enforcing Governance at the Speed of Development

Governance lives in Rego. We validate every change pre-execution and fail-closed with an audit trail.

Basic Policy Structure

package codecontext.egress

deny[msg] {
  input.estimated_tokens > input.budget.max_tokens
  msg := sprintf("Token budget exceeded: %d > %d", [input.estimated_tokens, input.budget.max_tokens])
}

deny[msg] {
  input.files[_].contains_pii == true
  msg := "Cannot process files containing PII"
}

allow {
  count(deny) == 0
}

Advanced Governance Patterns

Our enterprise customers use sophisticated policies to enforce compliance, security, and operational constraints:

Budget Enforcement

package codecontext.budget

# Enforce daily spending limits
deny[msg] {
  daily_spend := sum([c.cost | c := input.today_campaigns[_]])
  daily_spend > input.org.daily_budget
  msg := sprintf("Daily budget exceeded: $%.2f > $%.2f", [daily_spend, input.org.daily_budget])
}

# Require approval for large campaigns
require_approval {
  input.campaign.estimated_cost > 1000
}

This policy framework ensures that AI operations remain within approved budgets and require appropriate approvals for significant expenditures.