Use Cases

How It Works

Customers

Resources

Company

Sign in

Request a Demo

Programmable Governance

Your Access Policy, as Real Code

Access policy today lives in ticket queues, tribal knowledge, and one-off scripts that no one audits and everyone forgets. OpalScript is a purpose-built language for encoding access logic — approval workflows, JIT rules, SoD constraints, break-glass procedures — as version-controlled, testable, composable automations. Security engineers write it by hand. Everyone else describes what they need, and AI generates it. Either way, the output is auditable code, not a Jira comment.

Get a Demo

See the Platform

Programmable Governance

Your Access Policy, as Real Code

Access policy today lives in ticket queues, tribal knowledge, and one-off scripts that no one audits and everyone forgets. OpalScript is a purpose-built language for encoding access logic — approval workflows, JIT rules, SoD constraints, break-glass procedures — as version-controlled, testable, composable automations. Security engineers write it by hand. Everyone else describes what they need, and AI generates it. Either way, the output is auditable code, not a Jira comment.

Get a Demo

See the Platform

Programmable Governance

Your Access Policy, as Real Code

Access policy today lives in ticket queues, tribal knowledge, and one-off scripts that no one audits and everyone forgets. OpalScript is a purpose-built language for encoding access logic — approval workflows, JIT rules, SoD constraints, break-glass procedures — as version-controlled, testable, composable automations. Security engineers write it by hand. Everyone else describes what they need, and AI generates it. Either way, the output is auditable code, not a Jira comment.

Get a Demo

See the Platform

Programmable Governance

Your Access Policy, as Real Code

Access policy today lives in ticket queues, tribal knowledge, and one-off scripts that no one audits and everyone forgets. OpalScript is a purpose-built language for encoding access logic — approval workflows, JIT rules, SoD constraints, break-glass procedures — as version-controlled, testable, composable automations. Security engineers write it by hand. Everyone else describes what they need, and AI generates it. Either way, the output is auditable code, not a Jira comment.

Get a Demo

See the Platform

TRUSTED BY LEADING COMPANIES

TRUSTED BY LEADING COMPANIES

TRUSTED BY LEADING COMPANIES

TRUSTED BY LEADING COMPANIES

The Problem

Access Policy Without a Language Isn't Policy — It's Tribal Knowledge

Every security team has access policies. Almost none of them are executable. Approval chains live in someone's head. JIT rules are duct-taped together with one-off scripts. Break-glass procedures exist as a wiki page no one has read since onboarding. When the policy isn't code, it can't be tested, can't be version-controlled, can't be peer-reviewed, and can't scale. The result is shadow policy — manual runbooks and ad-hoc automations that drift from intent the moment they're created.

0%

of traditional IGA platforms offer a purpose-built policy language

Shadow policy

One-off scripts, spreadsheets, and tribal knowledge fill the gap

Manual by default

Policy changes ship through ticket queues and Slack threads, not pull requests

The Problem

Access Policy Without a Language Isn't Policy — It's Tribal Knowledge

Every security team has access policies. Almost none of them are executable. Approval chains live in someone's head. JIT rules are duct-taped together with one-off scripts. Break-glass procedures exist as a wiki page no one has read since onboarding. When the policy isn't code, it can't be tested, can't be version-controlled, can't be peer-reviewed, and can't scale. The result is shadow policy — manual runbooks and ad-hoc automations that drift from intent the moment they're created.

0%

of traditional IGA platforms offer a purpose-built policy language

Shadow policy

One-off scripts, spreadsheets, and tribal knowledge fill the gap

Manual by default

Policy changes ship through ticket queues and Slack threads, not pull requests

The Problem

Access Policy Without a Language Isn't Policy — It's Tribal Knowledge

Every security team has access policies. Almost none of them are executable. Approval chains live in someone's head. JIT rules are duct-taped together with one-off scripts. Break-glass procedures exist as a wiki page no one has read since onboarding. When the policy isn't code, it can't be tested, can't be version-controlled, can't be peer-reviewed, and can't scale. The result is shadow policy — manual runbooks and ad-hoc automations that drift from intent the moment they're created.

0%

of traditional IGA platforms offer a purpose-built policy language

Shadow policy

One-off scripts, spreadsheets, and tribal knowledge fill the gap

Manual by default

Policy changes ship through ticket queues and Slack threads, not pull requests

The Problem

Access Policy Without a Language Isn't Policy — It's Tribal Knowledge

Every security team has access policies. Almost none of them are executable. Approval chains live in someone's head. JIT rules are duct-taped together with one-off scripts. Break-glass procedures exist as a wiki page no one has read since onboarding. When the policy isn't code, it can't be tested, can't be version-controlled, can't be peer-reviewed, and can't scale. The result is shadow policy — manual runbooks and ad-hoc automations that drift from intent the moment they're created.

0%

of traditional IGA platforms offer a purpose-built policy language

Shadow policy

One-off scripts, spreadsheets, and tribal knowledge fill the gap

Manual by default

Policy changes ship through ticket queues and Slack threads, not pull requests

How Opal Solves It

From Prose Policies to Executable Code

OpalScript is a Python-like language purpose-built for access logic. It gives security teams the same infrastructure-as-code discipline that platform engineers use with Terraform — but for access policy. Define approval workflows, JIT rules, SoD constraints, and break-glass procedures as code that's testable, composable, and peer-reviewable. Ship it through Git and CI/CD. And if you don't write code, describe what you need in plain English — Opal's AI assistant or a coding agent like Claude Code generates the OpalScript for you.

Version-controlled policy that ships through Git · AI-assisted authoring for every practitioner · Auditable execution with full event trail

Key Capabilities

1. A Real Language for Access Logic

OpalScript isn't a configuration toggle or a YAML template. It supports conditional logic, loops, string matching, and composable actions — giving security teams the expressiveness to encode policies that match how access decisions actually work. If you can describe the rule, you can encode it.

Learn more

1. A Real Language for Access Logic

OpalScript isn't a configuration toggle or a YAML template. It supports conditional logic, loops, string matching, and composable actions — giving security teams the expressiveness to encode policies that match how access decisions actually work. If you can describe the rule, you can encode it.

2. AI-Assisted Authoring

Security engineers can write OpalScript by hand. Everyone else describes what they need, and AI generates it. Opal's built-in AI assistant modifies scripts based on natural language instructions — "switch from AWS IAM roles to GCP," "add a manager approval requirement for production databases," "auto-approve non-sensitive access under 4 hours." The AI operates on the existing script, making surgical changes while preserving structure and logic. No AI-generated code executes without human review.

Learn more

2. AI-Assisted Authoring

Security engineers can write OpalScript by hand. Everyone else describes what they need, and AI generates it. Opal's built-in AI assistant modifies scripts based on natural language instructions — "switch from AWS IAM roles to GCP," "add a manager approval requirement for production databases," "auto-approve non-sensitive access under 4 hours." The AI operates on the existing script, making surgical changes while preserving structure and logic. No AI-generated code executes without human review.

3. Ships Like Infrastructure

OpalScript integrates with the tools security and platform engineers already use. Policies are version-controlled in Git, deployed through Terraform and CI/CD pipelines, and peer-reviewed in pull requests. Bringing a new system under governance is part of the deployment process — not an afterthought filed as a Jira ticket three sprints later.

Learn more

3. Ships Like Infrastructure

OpalScript integrates with the tools security and platform engineers already use. Policies are version-controlled in Git, deployed through Terraform and CI/CD pipelines, and peer-reviewed in pull requests. Bringing a new system under governance is part of the deployment process — not an afterthought filed as a Jira ticket three sprints later.

4. Auditable by Design

Every OpalScript automation runs on a Service User — Opal's programmatic identity primitive — with its own identity, permissions, API keys, and full event trail. Every execution is logged with actor attribution, timestamp, duration, and outcome. Auditors can trace any automated access decision back to the exact script, the exact policy version, and the exact context that produced it.

Learn more

4. Auditable by Design

Every OpalScript automation runs on a Service User — Opal's programmatic identity primitive — with its own identity, permissions, API keys, and full event trail. Every execution is logged with actor attribution, timestamp, duration, and outcome. Auditors can trace any automated access decision back to the exact script, the exact policy version, and the exact context that produced it.

Impact

100%

Audit trail coverage — every automated decision traceable to the script and policy version that governed it

100%

Audit trail coverage — every automated decision traceable to the script and policy version that governed it

< 500ms

Median script execution latency

< 500ms

Median script execution latency

> 99%

Execution success rate

> 99%

Execution success rate

Beyond Programmable Governance

Beyond Programmable Governance

The Platform Advantage

The Platform Advantage

OpalScript doesn't operate in isolation — it's the encoding layer in Opal's See → Encode → Enforce loop. The policies you write in OpalScript are enforced by Paladin. The identity context they evaluate comes from OpalQuery. And every execution feeds back into the access graph, sharpening future decisions.

OpalQuery operates against Opal's unified identity and access graph; users, resources, and groups from every connected system. A few examples:

Access intelligence

OpalQuery surfaces the access posture that informs what policies to write: SoD conflicts, orphaned accounts, over-provisioned roles, and drift from intended state

AI-powered reviews

Paladin enforces OpalScript policies as a first-class reviewer in the approval chain, resolving routine decisions autonomously and escalating with specific reasoning

Just-in-time access

OpalScript encodes the JIT rules, duration caps, and break-glass procedures that govern time-bound access across your environment

Agent identity governance

OpalScript policies apply equally to human and non-human identities, including AI agents and service accounts

Trusted by security teams that ship fast and sleep well.

86K

Time-bound access requests

JIT Access and UARs Enhance Productivity and Security at Databricks

See customer story

Trusted by security teams that ship fast and sleep well.

  • 86K

    Time-bound access requests

    JIT Access and UARs Enhance Productivity and Security at Databricks

    See customer story

  • 5,353

    Okta entitlements governed

    How Mercari Built Zero-Touch Access to Production

    See customer story

  • 5,000

    Employees secured

    Blend Transforms Identity Security with Deterministic Logic

    See customer story

  • 150+

    Apps under governance

    Superhuman Reduced Access Risk While Improving End-User Experience

    See customer story

Trusted by security teams that ship fast and sleep well.

86K

Time-bound access requests

JIT Access and UARs Enhance Productivity and Security at Databricks

See customer story

Trusted by security teams that ship fast and sleep well.

86K

Time-bound access requests

JIT Access and UARs Enhance Productivity and Security at Databricks

See customer story

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Book a Demo

See the Platform

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Book a Demo

See the Platform

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Book a Demo

See the Platform

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Book a Demo

See the Platform

Stop Reviewing.

Start Enforcing.

Use Cases

Just-in-Time Access

AI-Powered Access Reviews

Programmable Governance

Access Intelligence

Security for AI Agents

How it Works

Platform

Integrations

Intelligence

Customers

Blend

Databricks

Mercari

Superhuman

All Case Studies

Resources

Resource Center

Documentation

Features

Blog

Media & Press

Events

Glossary

Brand Resouces

Company

About

Careers

Trust Center

Legal

Terms of Service

Privacy Policy

Stop Reviewing.

Start Enforcing.

Use Cases

Just-in-Time Access

AI-Powered Access Reviews

Programmable Governance

Access Intelligence

Security for AI Agents

How it Works

Platform

Integrations

Intelligence

Customers

Blend

Databricks

Mercari

Superhuman

All Case Studies

Resources

Resource Center

Documentation

Features

Blog

Media & Press

Events

Glossary

Brand Resouces

Company

About

Careers

Trust Center

Legal

Terms of Service

Privacy Policy

Stop Reviewing.

Start Enforcing.

Use Cases

Just-in-Time Access

AI-Powered Access Reviews

Programmable Governance

Access Intelligence

Security for AI Agents

How it Works

Platform

Integrations

Intelligence

Customers

Blend

Databricks

Mercari

Superhuman

All Case Studies

Resources

Resource Center

Documentation

Features

Blog

Media & Press

Events

Glossary

Brand Resouces

Company

About

Careers

Trust Center

Legal

Terms of Service

Privacy Policy

Stop Reviewing.

Start Enforcing.

Use Cases

Just-in-Time Access

AI-Powered Access Reviews

Programmable Governance

Access Intelligence

Security for AI Agents

How it Works

Platform

Integrations

Intelligence

Customers

Blend

Databricks

Mercari

Superhuman

All Case Studies

Resources

Resource Center

Documentation

Features

Blog

Media & Press

Events

Glossary

Brand Resouces

Company

About

Careers

Trust Center

Legal

Terms of Service

Privacy Policy