OPA Open Policy Agent
Generic policy engine — "is this user allowed to do X on resource Y?". Rego is the language.
Centralises authorisation away from each service. Integrates into Kubernetes (admission control), Terraform (policy-as-code), API gateways. CNCF graduated. Kubernetes competitor: Kyverno (YAML instead of Rego).