Risor vs OPA / Rego

OPA (Open Policy Agent) is the CNCF-backed standard for policy evaluation. Its language, Rego, is powerful but requires learning a declarative, logic-programming paradigm. Rego is the most common reason teams move away from OPA. As one r/kubernetes thread put it, "everyone loves policy as code, no one wants to write Rego."

Risor gives you the same safety properties in TypeScript-like imperative syntax.

Side-by-Side: Access Control

Rego

package authz
 
import rego.v1
 
default allow := false
 
allow if {
    some role in input.user.roles
    role == "admin"
}
 
allow if {
    some role in input.user.roles
    role == required_role
}
 
required_role := "public" if {
    input.resource.classification == "public"
}
 
required_role := "internal" if {
    input.resource.classification == "internal"
}
 
required_role := "confidential" if {
    input.resource.classification == "confidential"
}

Risor

let user = input.user
let resource = input.resource
 
let is_admin = any(user.roles.map(r => r == "admin"))
let has_role = any(user.roles.map(r => r == resource.classification))
 
is_admin || has_role

Comparison

Performance

OPA is 3× faster on trivial expressions (4.9 µs vs Risor's 15.2 µs), but Rego's evaluation model breaks down at scale. On data processing (10,000 records), Risor finishes in 4.20 ms while OPA takes 11.91 ms (2.8× slower). On business logic, Risor runs in 273 µs versus OPA's 1,380 µs (5.1× slower). OPA's query planner re-evaluates rules per-row, which compounds with dataset size. (Full benchmarks.)

Memory tells a similar story. OPA carries a partial evaluation index that costs 80.0 KB per instance even for a simple expression, versus Risor's 2.2 KB. For business logic: 100.4 KB versus 7.6 KB.

When to Choose OPA

• Your team already knows Rego
• You need Kubernetes admission control (OPA Gatekeeper)
• You need CNCF governance and Styra enterprise support

When to Choose Risor

• Your team writes imperative code and doesn't want a declarative paradigm
• You need policy evaluation embedded directly in your application
• You want the host to control which language features policy authors can use

Learn More

• Getting Started
• Language Overview
• Embedding Risor