Skip to main content

Migration from Styra DAS™ and Enterprise OPA

EnforceAuth supports incremental migration from legacy Styra DAS™ deployments and Enterprise OPA (EOPA) fleets without forced re-architecture.

Choosing EOPA vs OSS OPA for a greenfield deployment? See OPA vs EOPA. This page covers DAS™ / EOPA → EnforceAuth cutover.

Historical products and trademarks

Styra DAS™ was Styra's commercial policy control plane. It was decommissioned on April 30, 2026.

Enterprise OPA (EOPA) was donated to the CNCF Open Policy Agent project as a PDP subproject (open-policy-agent/eopa).

EnforceAuth replaces the control-plane capabilities DAS™ provided — enterprise console, multi-environment promotion, fleet monitoring, decision-log ingestion, MCP, and supported operations.

In 2025, Styra's core engineering team joined Apple in an acqui-hire; Styra no longer operates as an independent company.

EnforceAuth may refer to Styra DAS™ when describing migration paths; Styra and Apple have stated there is no restriction on such references. DAS™ may be a trademark of its respective owner. EnforceAuth is not affiliated with or endorsed by Apple Inc.

Why teams migrate now​

DriverDetail
DAS™ end of lifeControl plane decommissioned April 30, 2026 — no ongoing Styra vendor support
Control plane ownershipEnforceAuth provides enterprise policy lifecycle, promotion, audit, and fleet visibility
ContinuityKeep EOPA PDPs on the data plane; change bundle source and telemetry to EnforceAuth

What carries over​

  • Rego policies — largely portable; review legacy builtins or data layouts from the DAS™ era
  • EOPA PDPs — keep running EOPA sidecars/daemons; point bundle polling and decision logs at EnforceAuth
  • Git workflows — EnforceAuth uses Git-backed policy sources (same mental model as DAS™ Git integration)
  • Bundle format — standard OPA bundle.tar.gz

Phased approach​

PhaseActivity
1. AssessInventory systems, former DAS™ stacks, bundle paths, decision log volume, EOPA config (masking, partitions)
2. Parallel runEnforceAuth dev/staging; compare decisions via log replay
3. Cutover per systemPromote bundle destination; redirect PDP bundle URL; wire EnforceAuth API keys for decision_logs
4. Decommission DAS™Confirm DAS™ control plane is fully retired (product already deprecated April 30, 2026)

PDP guidance during migration​

Most DAS™ customers already run EOPA as the PDP. During cutover:

  1. Keep EOPA on the data plane — change only the control plane and bundle source
  2. Configure bundle destination and PDP integration to match EnforceAuth deploy output
  3. Preserve decision_logs.mask and partition config from your existing EOPA config.yaml
  4. Validate with OPA vs EOPA before switching PDP binary to OSS OPA

Log replay​

Use EnforceAuth log replay (API aligned with historical DAS™ replay patterns) to test draft policies against historical decisions before production promotion.

Get help​

Contact EnforceAuth for migration workshops with enterprise accounts.

Next​