feat(governance): Integrate OPA policy engine for guardrails

[adwiteeymauriya]

Summary

Integrate Open Policy Agent (OPA) for flexible, declarative guardrail policies.

Benefits

• Declarative policy language (Rego)
• Battle-tested in enterprise (Kubernetes, Terraform, Envoy)
• Easy to audit and version
• Separation of policy from code

Example Policies

Context Access Control

package duragraph.guardrails

default allow_context = false

allow_context {
  input.source.classification != "restricted"
  input.user.clearance_level >= input.source.required_clearance
  input.source.age_hours < 24
}

Output Filtering

package duragraph.guardrails

deny_output[msg] {
  contains_pii(input.response)
  msg := "Response contains PII"
}

deny_output[msg] {
  input.response.confidence < 0.7
  msg := "Low confidence response"
}

Implementation

• Embed OPA as library (not separate service)
• Hot-reload policy updates
• Policy versioning and rollback
• Policy testing framework

References

• Open Policy Agent
• Spec: spec/governance/ai-context-governance.yml