Available now — Open Source

NPA

Intelligent policy engine. Blazing fast. Python-native. OPA-compatible.
200,000+ decisions per second — 60× less memory than OPA.

View on GitHub Live Rego Playground Contact / Support
NPA – NextPolicyAgent: Python-native Policy Engine

Why NPA?

Policy engines are the backbone of modern security architectures. Existing solutions like OPA are written in Go, require separate processes, and bring significant overhead. NPA combines the proven Rego language with the flexibility of Python — no language barrier, no foreign binaries, no performance compromises.

Python-native embedding

Embed NPA directly as a Python library — no HTTP calls, no serialization overhead, no network latency. Pure in-process speed: 200,000+ decisions per second at ~5 µs per evaluation.

60× less memory

While OPA typically uses 20–30 MB RAM, NPA gets by with 0.5 MB peak — even with all policies loaded. More containers on the same cluster, ideal for sidecars and edge scenarios.

OPA drop-in replacement

NPA implements the complete OPA REST API. Replace existing OPA deployments without changing a single line of client code. All 192+ Rego built-in functions included.

Interactive Rego Policy Playground

Experience how NPA evaluates a Rego authorization policy in microseconds. Toggle the request input attributes below and watch the decision update in real time.

policy/authz.rego 100% OPA Rego-compatible 
package authz

default allow := false

# Rule 1: Admins have full access over verified TLS
allow if {
    input.tls_verified == true
    input.role == "admin"
}

# Rule 2: Developers may read or deploy in dev/staging
allow if {
    input.tls_verified == true
    input.role == "developer"
    input.action == "read"
}
Live Input & Evaluation engine.decide("data.authz.allow", input)
input.role
input.action
input.tls_verified
input = { "role": "admin", "action": "deploy", "tls_verified": true }
✅ ALLOW (true) ⚡ 4.6 µs · 0 HTTP calls · 0.5 MB RAM

Rule 1 matched: Role "admin" over a verified TLS connection is granted full access to all actions.

Key strengths

Integrated web dashboard

7-page SPA with live metrics, policy editor with syntax highlighting, interactive playground, data browser, bundle management, decision logs and configuration — all out of the box.

HTTPS by default

TLS 1.2+ enabled by default with automatic certificate generation for development. Session-based auth, security headers (HSTS, X-Content-Type-Options), GZip compression and CORS.

Linear scaling

Predictable performance — only ~0.22 µs per additional rule. Even with 100 rules, NPA delivers 32,000+ decisions per second.

Modern architecture

Built on FastAPI + uvicorn (ASGI), Typer + Rich CLI, multi-layer caching, plugin system, dual storage (in-memory / SQLite) and full OpenTelemetry + Prometheus observability.

From CLI to container

13 CLI commands, Docker-ready, Swagger/ReDoc documentation — everything DevOps teams need. Development, testing, and production workflows fully covered.

NPA vs OPA at a glance

Feature comparison

  • Language: Python 3.12+ vs Go
  • SDK embedding: Direct in Python apps (~5 µs) vs not available
  • SDK throughput: 200,000+ eval/s vs —
  • REST API latency: < 1 ms vs < 0.5 ms
  • Memory usage: 0.5 MB vs 20–30 MB
  • Web dashboard: 7-page SPA vs none
  • TLS by default: Yes, with auto-cert vs manual
  • Rego-compatible: Yes (192+ built-ins) vs native
  • License: GPL-3.0 (Open Source) vs Apache 2.0

Performance & memory benchmarks

In-Process SDK Throughput (NPA)200,000+ eval/s
Memory Footprint NPA (Peak)0.5 MB
Memory Footprint OPA (Typical)25–30 MB
Linear Scaling (100 Rules)32,000+ eval/s (~31 µs)

Deployment & Operating Models

Run NPA embedded inside your Python stack, as a standalone container sidecar, or backed by commercial enterprise support.

In-Process · ~5 µs Latency

Python SDK & Open Source

Direct embedding into FastAPI, Django, Flask, or ML pipelines under GPL-3.0.

  • 200,000+ decisions/sec with zero network overhead
  • Only 0.5 MB peak memory footprint in-process
  • Full support for 192+ Rego built-in functions
  • Freely available on GitHub
GitHub Repository
OPA Drop-in · Sidecar & NS8

Self-Hosted Server & Sidecar

Standalone policy server via Docker, Kubernetes sidecar, or NethServer 8.

  • 100% OPA-compatible REST API (/v1/data/...)
  • Built-in 7-page web dashboard & policy editor
  • HTTPS / TLS 1.2+ by default with auto-certificate
  • OpenTelemetry tracing & Prometheus metrics
Request Architecture Info
Regulated Enterprises

Enterprise Support & Custom

Commercial backing, custom policy engineering, and guaranteed SLAs by BLS-ISP.

  • Migration of existing OPA/Gatekeeper policies to NPA
  • Custom Python built-in plugin development
  • Commercial licensing options & security reviews
  • Direct core-engineer support & response SLAs
Contact Enterprise Team

Use cases

API gateway & microservices

Central authorization for all microservices. NPA as sidecar or central policy server — under 1 ms response time.

Kubernetes admission control

Pod validation, namespace policies, resource quotas — all defined in Rego and enforced by NPA. Compatible with existing OPA/Gatekeeper policies.

CI/CD pipeline security

Policy-as-Code in the build process: compliance checks, license validation, security scanning — automated and reproducible.

Python apps & ML pipelines

NPA embedded directly as SDK — 200,000 policy decisions per second without HTTP overhead. Perfect for real-time inference with policy enforcement.

Get started in 60 seconds

Python CLI & Server

Install via pip and launch with the built-in 7-page web dashboard:

pip install npa
npa run --addr 0.0.0.0:8443
# Dashboard: https://localhost:8443

Docker Container

Run as a container with HTTPS enabled by default:

docker run -d -p 8443:8443 npa:latest
curl -sk https://localhost:8443/health

Embed as Python SDK

Decisions in ~5 µs directly inside your Python process:

from npa.sdk.sdk import NPA

engine = NPA()
engine.load_policy("authz.rego", policy)
ok = engine.decide("data.authz.allow", {"role": "admin"})

Frequently Asked Questions

Technical answers on OPA compatibility, performance, memory footprint, and licensing.

Is NPA 100% compatible with our existing OPA policies?
Yes. NPA supports Rego v1 with 192+ built-in functions (JWT, crypto, regex, SemVer, graph, CIDR, time, etc.) and implements the full OPA REST API (/v1/data, /v1/policies, bundles). You can swap out existing OPA instances without changing client code.
When should I use the Python SDK vs. the REST server?
For Python applications (FastAPI, Django, ML pipelines), embedding the SDK delivers maximum speed (~5 µs per decision, zero network hop). For polyglot microservices, API gateways, or Kubernetes admission control, run the NPA ASGI server with its built-in 7-page web dashboard.
How does NPA achieve 60× lower memory usage than OPA?
Through compact AST representation, multi-layer evaluation caching, and eliminating a separate Go runtime per sidecar, the NPA engine requires only ~0.5 MB peak memory for compiled policies and data.
Is commercial enterprise support or custom licensing available?
NPA is open source under the GPL-3.0 license. For organizations requiring proprietary embedding, guaranteed SLAs, or custom policy engineering, BLS-ISP provides commercial licensing and enterprise support packages.

Repository

NPA is open source under the GNU General Public License v3.0. Contributions, bug reports and feature requests are welcome.