How do you integrate Open Policy Agent (OPA) into CI/CD without slowing delivery to a crawl?

The usual failure mode is a security gate so slow or noisy that teams bypass it. For Open Policy Agent (OPA), the practical levers are: scan only what changed on pull requests and keep the exhaustive scan for a nightly or pre-release run; cache whatever database or ruleset the tool downloads so CI is not re-fetching it every job; and parallelise across services rather than scanning a monorepo serially.

Severity policy matters as much as speed. Blocking on every finding trains people to add blanket suppressions. A workable policy blocks on Critical (and often High) with a documented, time-boxed exception process, while everything lower is tracked as a ticket rather than a hard stop.

For this tool specifically, tune the Rego language, OPA as a general decision engine vs Gatekeeper for Kubernetes admission, ConstraintTemplates and Constraints, policy unit testing with opa test, dry-run/audit mode before enforcing, and conftest for validating IaC before apply. Finally, make the gate honest: an admission webhook denying a Pod that runs as root or lacks resource limits. A gate that warns but never blocks is documentation, not a control.