Why OPA and Rego are not enough for AI governance

The crisis of traditional tools in the AI era

For years, Open Policy Agent (OPA) has established itself as the gold standard for open-source infrastructure. Its ability to manage authorizations and admission controls in distributed systems using the Rego language is indisputable. However, as companies integrate LLMs and autonomous agents, we are forcing technology designed for structured data to solve problems involving human judgment and ambiguous context.

As we explored in our article Model Output Is Not Authority: Seguridad y Programación en Agentes IA, controlling AI workflows requires a level of sophistication that goes far beyond deterministic validations.

The data model limit: Why does OPA fail here?

OPA shines when evaluating JSON against predictable rules. It is fast, auditable, and perfect for Kubernetes or Terraform. The problem arises with AI, where the input is unstructured text.

To apply a compliance policy, such as protecting medical data (PHI), OPA would require:

• Complex preprocessing: Transforming natural language into structured data before evaluation.
• Fragility: Any change in the extraction model breaks the policy.
• Lack of semantics: OPA does not understand tone, intent, or organizational context.

"Treating AI governance as an infrastructure problem creates systems that are technically sophisticated but practically useless."

Toward meaning-based governance

True AI governance requires an engine that combines three layers of evaluation:

1. Deterministic rules: For pattern-based checks (keywords, regex).
2. Semantic evaluation: The ability to understand nuances, such as the difference between a professional tone and a condescending one—something unattainable with traditional static rule programming.
3. Organizational context (RAG-based): Evaluating content by comparing it against internal documents (manuals, brand guidelines) without the need to manually extract every piece of data into JSON.

The barrier to entry for experts

One of the biggest problems is that Rego requires advanced technical knowledge. Governance, however, is the domain of legal and compliance teams. Forcing these profiles to learn a complex query language creates an inefficient translation layer where engineers interpret laws, increasing the risk of errors.

The future of governance lies in systems that use YAML and natural language, allowing policies to be readable and verifiable by business stakeholders. As with API Governance: The Art of Scalable and Secure Programming, the key is to standardize without sacrificing agility.

Conclusion

It is not about abandoning tools like OPA, but about recognizing their limits. OPA is excellent for infrastructure, but AI needs a governance engine that understands semantics, session state, and intent. Adopting specialized solutions will allow AI innovation to be not only fast but also responsible and secure.

Sources:

• Dev.to - Why OPA and Rego Don't Work for AI Governance