Use Cases

How It Works

Customers

Resources

Company

Request a Demo

Programmable Governance

Your Access Policy, as Real Code

Access policy today lives in ticket queues, tribal knowledge, and one-off scripts that no one audits and everyone forgets. OpalScript is a purpose-built language for encoding access logic — approval workflows, JIT rules, SoD constraints, break-glass procedures — as version-controlled, testable, composable automations. Security engineers write it by hand. Everyone else describes what they need, and AI generates it. Either way, the output is auditable code, not a Jira comment.

Get a Demo

See the Platform

Programmable Governance

Your Access Policy, as Real Code

Get a Demo

See the Platform

Programmable Governance

Your Access Policy, as Real Code

Get a Demo

See the Platform

Programmable Governance

Your Access Policy, as Real Code

Get a Demo

See the Platform

TRUSTED BY LEADING COMPANIES

The Problem

Access Policy Without a Language Isn't Policy — It's Tribal Knowledge

Every security team has access policies. Almost none of them are executable. Approval chains live in someone's head. JIT rules are duct-taped together with one-off scripts. Break-glass procedures exist as a wiki page no one has read since onboarding. When the policy isn't code, it can't be tested, can't be version-controlled, can't be peer-reviewed, and can't scale. The result is shadow policy — manual runbooks and ad-hoc automations that drift from intent the moment they're created.

0%

of traditional IGA platforms offer a purpose-built policy language

Shadow policy

One-off scripts, spreadsheets, and tribal knowledge fill the gap

Manual by default

Policy changes ship through ticket queues and Slack threads, not pull requests

The Problem

Access Policy Without a Language Isn't Policy — It's Tribal Knowledge

0%

of traditional IGA platforms offer a purpose-built policy language

Shadow policy

One-off scripts, spreadsheets, and tribal knowledge fill the gap

Manual by default

Policy changes ship through ticket queues and Slack threads, not pull requests

The Problem

Access Policy Without a Language Isn't Policy — It's Tribal Knowledge

0%

of traditional IGA platforms offer a purpose-built policy language

Shadow policy

One-off scripts, spreadsheets, and tribal knowledge fill the gap

Manual by default

Policy changes ship through ticket queues and Slack threads, not pull requests

The Problem

Access Policy Without a Language Isn't Policy — It's Tribal Knowledge

0%

of traditional IGA platforms offer a purpose-built policy language

Shadow policy

One-off scripts, spreadsheets, and tribal knowledge fill the gap

Manual by default

Policy changes ship through ticket queues and Slack threads, not pull requests

How Opal Solves It

From Prose Policies to Executable Code

OpalScript is a Python-like language purpose-built for access logic. It gives security teams the same infrastructure-as-code discipline that platform engineers use with Terraform — but for access policy. Define approval workflows, JIT rules, SoD constraints, and break-glass procedures as code that's testable, composable, and peer-reviewable. Ship it through Git and CI/CD. And if you don't write code, describe what you need in plain English — Opal's AI assistant or a coding agent like Claude Code generates the OpalScript for you.

Version-controlled policy that ships through Git · AI-assisted authoring for every practitioner · Auditable execution with full event trail

Key Capabilites

A Real Language for Access Logic

OpalScript isn't a configuration toggle or a YAML template. It supports conditional logic, loops, string matching, and composable actions — giving security teams the expressiveness to encode policies that match how access decisions actually work. If you can describe the rule, you can encode it.

Python-like syntax with if/elif/else, for loops, and boolean logic
Full request context API: requester identity, resource type, resource name, access parameters
Built-in actions: approve, comment, reject, escalate — composable within branching logic

AI-Assisted Authoring

Security engineers can write OpalScript by hand — everyone else describes what they need and AI generates it. Opal's built-in AI assistant accepts natural language instructions like "switch from AWS IAM roles to GCP" or "add a manager approval for production databases," making surgical changes while preserving existing structure. No AI-generated code executes without human review.

Built-in AI assistant in the OpalScript editor for iterative, natural-language script modification
Compatible with Claude Code, Opal's MCP server, and other coding agents for richer workflows
Every AI-generated policy goes through the same review, validation, and deployment process as hand-written code

Auditable by Design

Every OpalScript automation runs on a Service User — Opal's programmatic identity primitive — with its own identity, permissions, API keys, and full event trail. Every execution is logged with actor attribution, timestamp, duration, and outcome. Auditors can trace any automated access decision back to the exact script, the exact policy version, and the exact context that produced it.

Impact

100%

Audit trail coverage, every automated decision traceable to the script and policy version that governed it

100%

Audit trail coverage, every automated decision traceable to the script and policy version that governed it

< 500ms

Median script execution latency

< 500ms

Median script execution latency

> 99%

Execution success rate

> 99%

Execution success rate

Beyond Programmable Governance

The Platform Advantage

OpalScript doesn't operate in isolation — it's the encoding layer in Opal's See → Encode → Enforce loop. The policies you write in OpalScript are enforced by Paladin. The identity context they evaluate comes from OpalQuery. And every execution feeds back into the access graph, sharpening future decisions.

OpalQuery operates against Opal's unified identity and access graph; users, resources, and groups from every connected system. A few examples:

Access intelligence

OpalQuery surfaces the access posture that informs what policies to write: SoD conflicts, orphaned accounts, over-provisioned roles, and drift from intended state

AI-powered reviews

Paladin enforces OpalScript policies as a first-class reviewer in the approval chain, resolving routine decisions autonomously and escalating with specific reasoning

Just-in-time access

OpalScript encodes the JIT rules, duration caps, and break-glass procedures that govern time-bound access across your environment

Agent identity governance

OpalScript policies apply equally to human and non-human identities, including AI agents and service accounts

Trusted by security teams that ship fast and sleep well.

86K

Time-bound access requests

JIT Access and UARs Enhance Productivity and Security at Databricks

See customer story

Trusted by security teams that ship fast and sleep well.

86K
Time-bound access requests
JIT Access and UARs Enhance Productivity and Security at Databricks
See customer story
5,353
Okta entitlements governed
How Mercari Built Zero-Touch Access to Production
See customer story
5,000
Employees secured
Blend Transforms Identity Security with Deterministic Logic
See customer story
150+
Apps under governance
Superhuman Reduced Access Risk While Improving End-User Experience
See customer story

Trusted by security teams that ship fast and sleep well.

86K

Time-bound access requests

JIT Access and UARs Enhance Productivity and Security at Databricks

See customer story

Trusted by security teams that ship fast and sleep well.

86K

Time-bound access requests

JIT Access and UARs Enhance Productivity and Security at Databricks

See customer story

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Book a Demo

See the Platform

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Book a Demo

See the Platform

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Book a Demo

See the Platform

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Book a Demo

See the Platform

Stop Reviewing.

Start Enforcing.

Use Cases

Just-in-Time Access

AI-Powered Access Reviews

Programmable Governance

Access Intelligence

Security for AI Agents

How it Works

Platform

Integrations

Intelligence

Customers

Blend

Databricks

Mercari

Superhuman

All Case Studies

Resources

Resource Center

Documentation

Features

Blog

Media & Press

Events

Glossary

Brand Resouces

Company

About

Careers

Trust Center

Legal

Stop Reviewing.

Start Enforcing.

Use Cases

Just-in-Time Access

AI-Powered Access Reviews

Programmable Governance

Access Intelligence

Security for AI Agents

How it Works

Platform

Integrations

Intelligence

Customers

Blend

Databricks

Mercari

Superhuman

All Case Studies

Resources

Resource Center

Documentation

Features

Blog

Media & Press

Events

Glossary

Brand Resouces

Company

About

Careers

Trust Center

Legal

Stop Reviewing.

Start Enforcing.

Use Cases

Just-in-Time Access

AI-Powered Access Reviews

Programmable Governance

Access Intelligence

Security for AI Agents

How it Works

Platform

Integrations

Intelligence

Customers

Blend

Databricks

Mercari

Superhuman

All Case Studies

Resources

Resource Center

Documentation

Features

Blog

Media & Press

Events

Glossary

Brand Resouces

Company

About

Careers

Trust Center

Legal

Stop Reviewing.

Start Enforcing.

Use Cases

Just-in-Time Access

AI-Powered Access Reviews

Programmable Governance

Access Intelligence

Security for AI Agents

How it Works

Platform

Integrations

Intelligence

Customers

Blend

Databricks

Mercari

Superhuman

All Case Studies

Resources

Resource Center

Documentation

Features

Blog

Media & Press

Events

Glossary

Brand Resouces

Company

About

Careers

Trust Center

Legal

Programmable Governance

Your Access Policy, as Real Code

Programmable Governance

Your Access Policy, as Real Code

Programmable Governance

Your Access Policy, as Real Code

Programmable Governance

Your Access Policy, as Real Code

The Problem

0%

Shadow policy

Manual by default

The Problem

0%

Shadow policy

Manual by default

The Problem

0%

Shadow policy

Manual by default

The Problem

0%

Shadow policy

Manual by default

From Prose Policies to Executable Code

Key Capabilites

Key Capabilites

100%

100%

< 500ms

< 500ms

> 99%

> 99%

Access intelligence

AI-powered reviews

Just-in-time access

Agent identity governance

Trusted by security teams that ship fast and sleep well.

86K

Trusted by security teams that ship fast and sleep well.

86K

5,353

5,000

150+

Trusted by security teams that ship fast and sleep well.

86K

Trusted by security teams that ship fast and sleep well.

86K

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.

Policy That Ships Like Code, Because It Is Code

Stop encoding access logic in ticket queues and tribal knowledge. OpalScript gives every security team — from engineers who think in code to practitioners who work through AI — a shared language for programmable, auditable, scalable governance.