Regorus

Regorus is a fast, lightweight interpreter for Rego, the policy language of the Open Policy Agent (OPA), written in pure Rust. It parses and evaluates Rego policies against input data to produce policy decisions, aiming to be a rigorous enforcer of well-defined Rego semantics while staying compact and embeddable — including in no_std environments.

Maintained by Microsoft, Regorus tracks recent OPA releases (defaulting to Rego v1) and is largely conformant with the OPA test suite. Beyond Rust, it exposes bindings for C, C++, C#, Go, Java, JavaScript/WASM, Python, and Ruby, letting a single high-performance policy engine be embedded across many language ecosystems. Custom stateful builtins can be implemented in Rust to extend the language.

What You Get

• A pure-Rust Rego interpreter that parses and evaluates OPA policies
• An Engine API for loading modules, supplying input/data, and evaluating queries
• no_std compatibility for constrained and embedded environments
• Bindings for C, C++, C#, Go, Java, JavaScript (WASM), Python, and Ruby
• Extensibility via custom stateful builtins implemented in Rust

Common Use Cases

• Embedding policy-as-code authorization decisions directly into a Rust service
• Enforcing OPA/Rego policies in confidential-computing or no_std contexts
• Running Rego policy evaluation from non-Rust languages via bindings
• Evaluating configuration or admission policies without running a separate OPA server

Under The Hood

Architecture - Regorus is a classic interpreter pipeline expressed as Rust modules: lexer.rs tokenizes Rego source, parser.rs builds the ast.rs AST, a compiler//compile.rs stage lowers and index-checks it (indexchecker.rs, scheduler.rs for rule ordering), and interpreter//interpreter.rs evaluates against input and data. The public engine.rs Engine ties these together and manages the policy registry, builtins (builtins/), caching (cache.rs), and schema handling (schema/). An experimental rvm/ register VM and query/ support round out the evaluation paths. Language bindings/ wrap the engine for other ecosystems via FFI/WASM.

Tech Stack - Pure Rust, no_std-capable, organized as a Cargo project with benches/, xtask/ automation, optional mimalloc, and release automation via release-plz. Bindings target C/C++/C#/Go/Java/JS(WASM)/Python/Ruby.

Code Quality - Strong: an extensive tests/ tree (including OPA conformance suites), benchmarks, active CI, and consistent maintenance signals. The code is decomposed into small, single-responsibility modules mirroring interpreter phases, which keeps a large language implementation navigable. Microsoft’s stewardship adds security and conformance rigor.

API Design - The Rust surface is clean — construct an Engine, add_policy/add_data/set_input, then eval_query/eval_rule. Defaulting to Rego v1 and mirroring OPA semantics means existing OPA users transfer knowledge directly. The breadth of Rego itself makes the learning curve moderate, but the engine hides parser/compiler/interpreter complexity behind a small, well-documented API and the polyglot bindings keep integration boilerplate low.