How do I install the Opa Policy skill?

Run npx skillmds@latest add paulasilvatech/opa-policy in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Opa Policy skill do?

Use when editing tracked Rego, OPA, Gatekeeper templates, or policy constraints. It is listed under Coding & Dev Tools on SkillMD.

Is Opa Policy safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Opa Policy?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Opa Policy free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Opa Policy?

paulasilvatech (@paulasilvatech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Opa Policy by paulasilvatech — Agent Skill

Name: Opa Policy
Author: paulasilvatech

File contents

OPA and Gatekeeper Policies

Conventions

Keep policy evaluation pure and deterministic: no time-, network-, random-, or environment-dependent authorization decisions.
Use explicit package names, rule names, input shapes, and defaults so undefined data cannot become an accidental allow.
Return stable, actionable denial or violation messages without secrets or full sensitive objects.
Normalize sets and object traversal deliberately; do not depend on iteration order.
Keep allow and deny precedence explicit and fail closed for malformed or unsupported inputs.
Align each Gatekeeper ConstraintTemplate name, generated constraint kind, parameters schema, targets, and Rego package.
Scope constraints with deliberate match and exclusion rules; avoid exemptions broader than the documented compatibility need.
Keep generated security-baseline policy under scripts/golden-paths/ portable and deterministic.
Add fixtures for allowed, denied, missing, malformed, boundary, and exemption cases.

Verification

Rego formatting, parsing, and policy tests pass with the repository-supported OPA tooling.
Gatekeeper templates and constraints agree on API versions, kinds, names, and parameters.
Repeated evaluation of identical input produces identical structured results.

Do / Do Not

Do	Do not
Keep policy decisions stable, structured, and covered by allow and deny fixtures.	Hide exceptions, depend on evaluation order, or mutate external state.
Keep Gatekeeper templates and constraints schema-aligned.	Change parameters on one side without updating the other.

Checklist Before Opening a PR

The change matches this instruction's applyTo scope.
Formatting, parsing, and policy tests pass.
Allow, deny, missing, malformed, boundary, and exemption fixtures are covered.
Templates and constraints agree on API, kind, name, and parameters.
No unrelated edits or unresolved placeholders remain.

---name: opa-policydescription: Use when editing tracked Rego, OPA, Gatekeeper templates, or policy constraints.---# OPA and Gatekeeper Policies## Conventions- Keep policy evaluation pure and deterministic: no time-, network-, random-, or environment-dependent authorization decisions.- Use explicit package names, rule names, input shapes, and defaults so undefined data cannot become an accidental allow.- Return stable, actionable denial or violation messages without secrets or full sensitive objects.- Normalize sets and object traversal deliberately; do not depend on iteration order.- Keep allow and deny precedence explicit and fail closed for malformed or unsupported inputs.- Align each Gatekeeper `ConstraintTemplate` name, generated constraint kind, parameters schema, targets, and Rego package.- Scope constraints with deliberate match and exclusion rules; avoid exemptions broader than the documented compatibility need.- Keep generated security-baseline policy under `scripts/golden-paths/` portable and deterministic.- Add fixtures for allowed, denied, missing, malformed, boundary, and exemption cases.## Verification- Rego formatting, parsing, and policy tests pass with the repository-supported OPA tooling.- Gatekeeper templates and constraints agree on API versions, kinds, names, and parameters.- Repeated evaluation of identical input produces identical structured results.## Do / Do Not| Do | Do not || --- | --- || Keep policy decisions stable, structured, and covered by allow and deny fixtures. | Hide exceptions, depend on evaluation order, or mutate external state. || Keep Gatekeeper templates and constraints schema-aligned. | Change parameters on one side without updating the other. |## Checklist Before Opening a PR- [ ] The change matches this instruction's `applyTo` scope.- [ ] Formatting, parsing, and policy tests pass.- [ ] Allow, deny, missing, malformed, boundary, and exemption fixtures are covered.- [ ] Templates and constraints agree on API, kind, name, and parameters.- [ ] No unrelated edits or unresolved placeholders remain.

Frequently asked questions

Opa Policy