AI agent guardrails with OPA starter pack
A short path for engineers who want AI agent guardrails with Open Policy Agent: decisions outside the model, managed as policy as code.
Architecture in one line: the LLM proposes a tool call; a PEP builds a factsheet; OPA (PDP) returns allow / deny / ask; only then does the tool run. Terraform manages policies and attachments on the control plane. Details and diagrams start in Why Open Policy Agent for AI agent guardrails.
Try it free. Create an account at app.stackgen.com, then mint a personal access token to run Terraform labs that create agents and policies.
The five posts
- Why Open Policy Agent for AI agent guardrails. Origin, advantages, Pydantic AI and other frameworks DIY vs Aiden pre-equipped.
- Authorize AI agent tool calls with OPA. Enforcement point, factsheet, deny
gh secret set. - Manage AI agent policies as code with Terraform.
sg_policy+sg_agent_policy_attachment. - Time-based AI agent policies with OPA. Business hours and change freezes.
- Guardrails and human approval for AI agent tool calls. Allow / ask / deny and operator checklist.
Clone and test
git clone https://github.com/sks/sks.github.io.git
cd sks.github.io/samples/aiden-opa-policies
make opa-test
Sample README: samples/aiden-opa-policies.
Related
- Foundations: Defense in depth · Terraform for agent config · Aiden platform
- Full agents: Hard Way · Easy Way
- Series hub: Building an Enterprise AI Agent Platform in Go
- Provider docs: sg_policy
Stay in the loop — production notes on AI agents, workflows, and SRE.
Low volume — new posts and curated reading lists. Unsubscribe anytime.
FAQ
Where should I start with Aiden OPA policies?
Read why OPA exists and what Aiden ships pre-built, then authorize a deny rule locally with opa test, attach it with Terraform, add time windows, and finish with allow/ask/deny HITL.
Do I need an Aiden tenant for every lab?
No. Labs 01, 03, and 04 run with the OPA CLI only. Lab 02 needs a free StackGen account, a personal access token, and a workspace id.
Where is the cloneable sample code?
samples/aiden-opa-policies/ in the sks.github.io repository. Run make opa-test from that folder.
How do I get a token for Terraform?
Create a free account at app.stackgen.com, then open Personal access tokens under settings and mint a token for stackgen_token. Pin the StackGen provider to 0.1.48.