Learn vocabulary for Open Policy Agent (OPA) and Rego policy language: rules, data, queries, allow/deny, and partial rules.
0 / 30 completed
1 / 30
What is OPA (Open Policy Agent)?
OPA (CNCF Graduated project) is a general-purpose policy engine: you define policy in Rego (OPA's policy language), and OPA evaluates queries against that policy and data. Use cases: Kubernetes admission control, API authorization, Terraform plan evaluation, SSH access policies.
2 / 30
What is 'Rego' in OPA vocabulary?
Rego is a declarative, logic-based policy language (derived from Datalog). It queries structured data (JSON) using rules. Key concepts: package declarations, rules (producing booleans, strings, or sets), input (the request being evaluated), data (policy data), and partial rules (building reusable policy components).
3 / 30
What does 'input' refer to in OPA/Rego vocabulary?
In OPA, input is the data describing the thing being evaluated: for Kubernetes admission control, input is the admission review request (the k8s resource being created/modified). The Rego policy evaluates input against rules to check operations like CREATE and whether required labels exist.
4 / 30
What is the 'default allow' vs. 'default deny' policy pattern in OPA?
In OPA Rego: 'default allow = false' (deny-by-default) means every request is blocked unless a rule explicitly allows it — safer and easier to reason about. 'default allow = true' with specific deny rules is allow-by-default — harder to make comprehensive and easier to accidentally leave gaps.
5 / 30
What is a 'policy bundle' in OPA vocabulary?
OPA bundles are tarballs containing Rego policies, data files, and metadata. OPA instances can pull bundles from a bundle server (or OCI registry) — enabling centralized policy management across many OPA deployments. Bundles support versioning and signatures for integrity verification.
6 / 30
Alice: "Hey team, I'm trying to enforce that all API requests from our mobile app must include a valid user ID. I'm using OPA to do this. What does 'policy' mean in this context?"
In OPA, a 'policy' represents a collection of rules that govern how requests are handled. It's not just about data storage or authentication; it dictates specific behaviors and constraints enforced by the system. The policy is what determines if an API request passes or fails based on its criteria.
7 / 30
Mark (in a Slack channel) says: "I've added a Rego policy to block requests exceeding 1MB in size. This is a good example of using Rego to define..."
'Rego' is the programming language specifically designed for writing OPA policies. It's a declarative language – you describe *what* you want to achieve, not *how* to achieve it. This allows OPA to efficiently evaluate and enforce your rules.
8 / 30
Ben (in a PR description): "Implemented a new policy using Rego to restrict access to sensitive user data based on role. The input in this case refers to..."
Within the context of OPA and Rego policies, 'input' represents the data that is provided *to* the policy engine when a request arrives. This could be anything – user roles, IP addresses, specific fields in the request body—that the policy relies on to make its decisions. The policy then operates on this input according to its defined rules.
9 / 30
Chloe: "We're using a 'default allow' policy for new users, meaning anyone can access the system initially until we explicitly block them. What does this strategy achieve?"
The 'default allow' strategy is a common security practice where the system initially grants access unless explicitly denied by a policy. This provides a more flexible approach than always denying requests, which can be difficult to manage and potentially block legitimate users. It's often combined with more specific policies for sensitive operations or high-risk scenarios.
10 / 30
David: "Our team is packaging all our access control rules into a single 'policy bundle' for easier deployment and management. What's the primary benefit of this approach?"
A 'policy bundle' consolidates related policies into a single file or package. This streamlines deployment because you only need to update the bundle instead of individual Rego files. It also improves maintainability by grouping logically related rules together, reducing the chance of conflicts and making it easier to understand the overall security posture.
11 / 30
Alice: "Hey team, I'm trying to enforce that all API requests from our mobile app must include a valid user ID. I'm using OPA to do this. What does 'policy' mean in this context?"
In OPA, a 'policy' represents a collection of rules that govern how requests are handled. It's not just about data storage or authentication; it dictates specific behaviors and constraints enforced by the system. The policy is what determines if an API request passes or fails based on its criteria.
12 / 30
Mark (in a Slack channel) says: "I've added a Rego policy to block requests exceeding 1MB in size. This is a good example of using Rego to define..."
'Rego' is the programming language specifically designed for writing OPA policies. It's a declarative language – you describe *what* you want to achieve, not *how* to achieve it. This allows OPA to efficiently evaluate and enforce your rules.
13 / 30
Ben (in a PR description): "Implemented a new policy using Rego to restrict access to sensitive user data based on role. The input in this case refers to..."
Within the context of OPA and Rego policies, 'input' represents the data that is provided *to* the policy engine when a request arrives. This could be anything – user roles, IP addresses, specific fields in the request body—that the policy relies on to make its decisions. The policy then operates on this input according to its defined rules.
14 / 30
Chloe: "We're using a 'default allow' policy for new users, meaning anyone can access the system initially until we explicitly block them. What does this strategy achieve?"
The 'default allow' strategy is a common security practice where the system initially grants access unless explicitly denied by a policy. This provides a more flexible approach than always denying requests, which can be difficult to manage and potentially block legitimate users. It's often combined with more specific policies for sensitive operations or high-risk scenarios.
15 / 30
David: "Our team is packaging all our access control rules into a single 'policy bundle' for easier deployment and management. What's the primary benefit of this approach?"
A 'policy bundle' consolidates related policies into a single file or package. This streamlines deployment because you only need to update the bundle instead of individual Rego files. It also improves maintainability by grouping logically related rules together, reducing the chance of conflicts and making it easier to understand the overall security posture.
16 / 30
Alice: "Hey team, I'm trying to enforce that all API requests from our mobile app must include a valid user ID. I'm using OPA to do this. What does 'policy' mean in this context?"
In OPA, a 'policy' represents a collection of rules that govern how requests are handled. It's not just about data storage or authentication; it dictates specific behaviors and constraints enforced by the system. The policy is what determines if an API request passes or fails based on its criteria.
17 / 30
Mark (in a Slack channel) says: "I've added a Rego policy to block requests exceeding 1MB in size. This is a good example of using Rego to define..."
'Rego' is the programming language specifically designed for writing OPA policies. It's a declarative language – you describe *what* you want to achieve, not *how* to achieve it. This allows OPA to efficiently evaluate and enforce your rules.
18 / 30
Ben (in a PR description): "Implemented a new policy using Rego to restrict access to sensitive user data based on role. The input in this case refers to..."
Within the context of OPA and Rego policies, 'input' represents the data that is provided *to* the policy engine when a request arrives. This could be anything – user roles, IP addresses, specific fields in the request body—that the policy relies on to make its decisions. The policy then operates on this input according to its defined rules.
19 / 30
Chloe: "We're using a 'default allow' policy for new users, meaning anyone can access the system initially until we explicitly block them. What does this strategy achieve?"
The 'default allow' strategy is a common security practice where the system initially grants access unless explicitly denied by a policy. This provides a more flexible approach than always denying requests, which can be difficult to manage and potentially block legitimate users. It's often combined with more specific policies for sensitive operations or high-risk scenarios.
20 / 30
David: "Our team is packaging all our access control rules into a single 'policy bundle' for easier deployment and management. What's the primary benefit of this approach?"
A 'policy bundle' consolidates related policies into a single file or package. This streamlines deployment because you only need to update the bundle instead of individual Rego files. It also improves maintainability by grouping logically related rules together, reducing the chance of conflicts and making it easier to understand the overall security posture.
21 / 30
Alice: "Hey team, I'm trying to enforce that all API requests from our mobile app must include a valid user ID. I'm using OPA to do this. What does 'policy' mean in this context?"
In OPA, a 'policy' represents a collection of rules that govern how requests are handled. It's not just about data storage or authentication; it dictates specific behaviors and constraints enforced by the system. The policy is what determines if an API request passes or fails based on its criteria.
22 / 30
Mark (in a Slack channel) says: "I've added a Rego policy to block requests exceeding 1MB in size. This is a good example of using Rego to define..."
'Rego' is the programming language specifically designed for writing OPA policies. It's a declarative language – you describe *what* you want to achieve, not *how* to achieve it. This allows OPA to efficiently evaluate and enforce your rules.
23 / 30
Ben (in a PR description): "Implemented a new policy using Rego to restrict access to sensitive user data based on role. The input in this case refers to..."
Within the context of OPA and Rego policies, 'input' represents the data that is provided *to* the policy engine when a request arrives. This could be anything – user roles, IP addresses, specific fields in the request body—that the policy relies on to make its decisions. The policy then operates on this input according to its defined rules.
24 / 30
Chloe: "We're using a 'default allow' policy for new users, meaning anyone can access the system initially until we explicitly block them. What does this strategy achieve?"
The 'default allow' strategy is a common security practice where the system initially grants access unless explicitly denied by a policy. This provides a more flexible approach than always denying requests, which can be difficult to manage and potentially block legitimate users. It's often combined with more specific policies for sensitive operations or high-risk scenarios.
25 / 30
David: "Our team is packaging all our access control rules into a single 'policy bundle' for easier deployment and management. What's the primary benefit of this approach?"
A 'policy bundle' consolidates related policies into a single file or package. This streamlines deployment because you only need to update the bundle instead of individual Rego files. It also improves maintainability by grouping logically related rules together, reducing the chance of conflicts and making it easier to understand the overall security posture.
26 / 30
Alice: "Hey team, I'm trying to enforce that all API requests from our mobile app must include a valid user ID. I'm using OPA to do this. What does 'policy' mean in this context?"
In OPA, a 'policy' represents a collection of rules that govern how requests are handled. It's not just about data storage or authentication; it dictates specific behaviors and constraints enforced by the system. The policy is what determines if an API request passes or fails based on its criteria.
27 / 30
Mark (in a Slack channel) says: "I've added a Rego policy to block requests exceeding 1MB in size. This is a good example of using Rego to define..."
'Rego' is the programming language specifically designed for writing OPA policies. It's a declarative language – you describe *what* you want to achieve, not *how* to achieve it. This allows OPA to efficiently evaluate and enforce your rules.
28 / 30
Ben (in a PR description): "Implemented a new policy using Rego to restrict access to sensitive user data based on role. The input in this case refers to..."
Within the context of OPA and Rego policies, 'input' represents the data that is provided *to* the policy engine when a request arrives. This could be anything – user roles, IP addresses, specific fields in the request body—that the policy relies on to make its decisions. The policy then operates on this input according to its defined rules.
29 / 30
Chloe: "We're using a 'default allow' policy for new users, meaning anyone can access the system initially until we explicitly block them. What does this strategy achieve?"
The 'default allow' strategy is a common security practice where the system initially grants access unless explicitly denied by a policy. This provides a more flexible approach than always denying requests, which can be difficult to manage and potentially block legitimate users. It's often combined with more specific policies for sensitive operations or high-risk scenarios.
30 / 30
David: "Our team is packaging all our access control rules into a single 'policy bundle' for easier deployment and management. What's the primary benefit of this approach?"
A 'policy bundle' consolidates related policies into a single file or package. This streamlines deployment because you only need to update the bundle instead of individual Rego files. It also improves maintainability by grouping logically related rules together, reducing the chance of conflicts and making it easier to understand the overall security posture.
What will I practice in "OPA and Rego — Vocabulary and Language"?
This is a Policy As Code exercise set. It walks through 30 scenario-based multiple-choice questions built around real usage of policy as code terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 30 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the policy as code vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Policy As Code exercises?
See the Policy As Code exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — policy as code vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.