Rego Language

Most likely the input finally contained two matching resources. A complete rule may produce only one value, so a body that iterates and succeeds twice with different values raises an evaluation conflict and the whole query fails.

Silence is not evidence: a clean estate and a broken rule produce identical output. Replay a violating fixture and a sample of real objects offline — if the bad fixture also passes, the rule's body is undefined.

The comprehension collapses every offender into one array, and indexing it at [0] picks a single name. Move the iteration into the rule body so each binding produces its own set entry, and iterate the container field names so init and ephemeral containers are covered too.

Compile the rule with the resource set declared unknown, then translate the residual conditions into the inventory's own query language and run them there. OPA produces the filter; the inventory produces the list. Never stream a million records through the engine.

A partial set rule such as deny always produces a document, empty when nothing matched, and in Rego every value except false is truthy. So the expression succeeds whether or not the rule fired, and the test asserts nothing.

Strict mode promotes lint-grade problems to compile errors: duplicate imports, unused imports, unused local assignments, using input or data as a variable or rule name, and deprecated built-in aliases. Plain opa check only reports genuine parse and compile errors.

Decode it first: json.unmarshal turns the string into a value you can reference, and yaml.unmarshal does the same for embedded YAML. Until you decode, traversal sees one opaque string and finds none of the fields inside it.

Both filter the same evaluation trace. notes shows only what the policy itself said — print and trace output. fails shows only the expressions that did not hold, which is how you find where an undefined rule stopped.

OPA indexes rules that share a name using equality tests between a plain reference into input or data and a constant, so a query only evaluates the rules whose key matches. Negations, comprehensions, walks and helper calls cannot be indexed.

You can answer only if the fact was pinned. A licence list shipped in the policy's data document has a version you can name and replay; one fetched by http.send at decision time was never captured.

Rego forbids recursion. The compiler builds a dependency graph over rules and functions and rejects any cycle, so the helper never loads. Use a transitive-closure built-in, or resolve the chain before evaluation.

Standardize on deny sets for almost everything, because they are additive, tool-native and produce usable messages, then buy back the fail-closed property in the harness. Reserve an explicit allow decision for the few gates where a silently absent rule is unacceptable.

It pays when the same rules must be reported over several data stores and also enforced elsewhere, so one policy stays the single source of truth. For one stable rule over one store, a hand-written query is cheaper and easier to defend.