Platform teams choosing a policy language for agent and workload decisions.
Whether you need a general policy language or an analysable authorization language, and where either one stops.
The control gap
OPA and Rego are general. You can express almost any rule, including ones you will not be able to reason about in a year. Cedar is deliberately narrower so that policies can be analysed, which means some rules you want are awkward or impossible. For agent authorization both constraints bite: the decision often depends on request arguments that are easy in Rego and unnatural in an entity model, while the audit conversation wants exactly the analysability Cedar was designed for.
What good looks like
A language chosen for how the team will read, review, and test policies over time, with the outcomes that neither language provides added deliberately.
- Compare on review, not on authoring. The relevant question is whether a reviewer can tell what a policy permits six months later.
- Check how each expresses your hardest real rule, including one that depends on a request argument.
- Decide where the data comes from. Rego usually pulls context in; Cedar expects an entity model to already hold it.
- Plan for the third outcome. Both languages produce a decision; neither routes an approval or keeps an execution receipt.
A production workflow
- Write the same three rules in both languages: a simple allow, an argument threshold, and an exception.
- Have someone who did not write them explain what each permits.
- Test both against recorded traffic and compare the decisions, not the syntax.
- Decide separately how approval, expiry, and evidence are handled, since that is outside both.
Evidence to require
- The policy version that produced each decision, in whichever language.
- The input document or entity set the decision was made against.
- Decisions that differed between the two implementations during evaluation.
- The approval and execution record, which sits outside the policy engine in both cases.
Buyer checklist
- Who reviews policy changes, and can they read the language you are choosing?
- Does your hardest rule depend on a request argument or on a stored relationship?
- How is policy tested, and does the test suite run on recorded production traffic?
- What happens to a decision that should be neither allow nor deny?
Practical answers
Common implementation questions
Is Cedar simply a safer Rego?
It is a narrower language with analysis as a design goal, which is safer for the rules it can express and unhelpful for the ones it cannot. Rego's generality is a genuine advantage and a genuine review burden.
Can we use both?
Teams do, usually with Cedar or a relationship engine for durable object permissions and Rego for infrastructure and admission rules. The cost is two review paths, which is only worth paying if the two domains are genuinely separate.
Which does Endram use?
Endram evaluates tool calls with its own rule model and keeps the decision, the reason, and the policy version with each result. It is designed to sit at the tool boundary rather than to replace a general policy engine elsewhere in your stack.