Mneme HQ + Open Policy Agent
Open Policy Agent (OPA) is an open-source engine that answers allow-or-deny questions using policies written in a language called Rego. Mneme is an open-source tool that stores a team’s architectural decisions in the repository and checks code changes against them, either inside a coding agent before it writes a file or in CI on a pull request. Whether the two can work together is a research question. No Mneme adapter for OPA exists, and Mneme does not turn decisions into Rego.
Status: research
We are investigating whether a reviewed Mneme decision could be expressed as a Rego policy that an existing OPA deployment enforces. Nothing is built.
No automatic translation. Mneme does not convert a written decision into Rego, and no such converter is planned. Any mapping we test would be written and reviewed by a person.
What OPA does
OPA is a general-purpose policy engine and a graduated Cloud Native Computing Foundation project. A service sends OPA a structured request, OPA evaluates it against Rego policies, and the service acts on the answer. Teams use it to authorize API calls, to decide whether Kubernetes accepts a new workload (admission control) and to check infrastructure configuration.
- Evaluation: a service calls the representational state transfer (REST) API with an
inputdocument and gets back aresult. OPA can also be embedded as a Go library or compiled to WebAssembly. - Distribution: policies and data ship as bundles, each with a
revisionstring. - Records: decision logs record each evaluation with a
decision_id, the bundle revision, the input and the result. Sensitive fields can be masked.
OPA decides only on what it is sent. A policy on a deployment request can check the requested resource profile, because the request contains it. It cannot check how the code inside that deployment is structured.
Where a decision and a policy differ
A Mneme decision records what the team decided, where it applies, its current version and its history. Mneme checks code against it with a typed rule, a machine-checkable condition attached to the decision. A Rego policy records what a service may allow. The two overlap only when a decision can be stated in terms of fields that an OPA-backed service receives.
| Decision | Can an OPA policy express it? |
|---|---|
| “Production deployments use the approved CPU inference profile” | Possibly, if the request to deploy carries the profile name. A person would write and review the Rego rule. |
| “Request handlers use the storage adapter, never the database driver” | No. This is about code content, which a deployment request does not contain. Mneme checks it in CI, or with a hook in a coding agent Mneme supports, before the file is written. |
Two shapes we are investigating
- OPA as the enforcer. A person maps one reviewed decision to one Rego policy. The team that runs OPA publishes it as a bundle in the usual way, and a service that already asks OPA enforces it. The question is whether the decision’s scope (which files or services it covers), version and exceptions survive the mapping, and whether the bundle revision can be traced back to the decision version.
- OPA as an extra evaluator. An adapter asks OPA about structured input and records the answer alongside Mneme’s own result. OPA’s answer would not replace Mneme’s check, and OPA would not become a second record of the team’s decisions.
A first test would use a small fixture with one unambiguous decision and a hand-written policy, possibly through Conftest, which uses OPA to test configuration files. A result there would show only that one fixture works. It would not make Conftest or OPA a supported integration.
What this does not cover
- No decision-to-Rego compiler. Mneme does not generate, publish or activate Rego.
- No code-content checks in OPA. Rules about imports, file structure or code patterns stay with Mneme’s agent hooks and CI.
- No NVIDIA Sentry support. NVIDIA Sentry (not Sentry.io, the error-monitoring service), NVIDIA’s hardware security layer for AI agents, uses OPA internally, but an OPA result says nothing about Sentry.
FAQ
Can Mneme export decisions as Rego?
We already use OPA. What does Mneme add?
Is this related to the NVIDIA OpenShell work?
Related reading
- Policy as code: rules written as version-controlled logic that a machine can evaluate.
- Programmable AI policy is not enough for coding agents: why most of the policy a coding agent must follow was never written as policy.
- NVIDIA OpenShell Reference Architecture: agent access policy is not architecture governance.
- How enforcement works: where Mneme checks changes today.
Use what ships today
OPA work is research only. Mneme’s shipped checks run in supported coding agents and in CI.
Mneme also exposes its Decision Index through a standard MCP server for interoperable access from compatible tools.