OPA Configuration
Configure OPA enforcement mode, external OPA URL, and upload custom Rego policies.
Overview
The OPA Configuration page is accessible at Settings → OPA Policy Settings (/dashboard/settings/opa). Here you configure how the OPA engine operates and upload custom Rego policies.
Settings
Enforcement Mode
Toggle between enforcement modes:
| Mode | Description |
|---|---|
| Enforce | OPA decisions are applied to all tool call requests |
| Shadow | OPA evaluates requests but does not enforce — decisions are logged for analysis |
External OPA URL
If you run your own OPA instance, enter its URL here. Leave empty to use ArmorIQ's built-in OPA engine.
Custom Rego Policies
Upload your own Rego policy files to extend OPA's decision logic:
- Click Upload Rego Policy.
- Select a
.regofile from your system. - The file uploads and appears in the list of custom policies.
Managing Uploaded Policies
| Action | Description |
|---|---|
| View | See the uploaded Rego file name and upload date |
| Delete | Remove a custom Rego policy |
Saving
Click Save Configuration to apply your changes. The OPA engine picks up the new settings and policies immediately.
Custom Rego policies are evaluated alongside ArmorIQ's built-in policies. Write your Rego rules in the armoriq.authz package to integrate with the existing decision pipeline.