Policy-as-Code in the Wild: A Taxonomy and Dataset for Open Policy Agent from Github

Policy-as-Code (PaC) enables the definition, management, and enforcement of policies and regulations using source code, thereby supporting the application of software engineering practices and tools to policy management. While the gray literature and industrial tools indicate PaC is increasingly used in organizations, there is little academic literature on the topic. Hence, to understand how PaC is used in practice and to create a representative dataset of PaC scripts, we conducted a repository mining study. We selected Open Policy Agent (OPA) as the PaC framework because it is widely used in academia and industry and serves as a de facto standard for PaC. By mining 73 public GitHub repositories using OPA, we created a multi-level policy taxonomy comprising 5 top-level categories and 28 unique subtype categories at the lowest level. We also created a curated dataset of 101 OPA policy files. We believe the taxonomy and dataset can help both researchers and practitioners understand PaC's use cases and develop methods and tools to support automated policy management with PaC.