# Apply OPA policies

Decide not just whether a caller is authenticated, but whether that specific caller, claim, or credential is allowed to make this request at all. Field-level reference for every block here is in [OPA policies →](/products/affinidi-trust-fabric/agent-stream/reference/policies/opa-policies.md).

| Guide | What you will achieve |
| [Control access to a surface with an OPA policy](/products/affinidi-trust-fabric/agent-stream/how-to-guides/policies/control-access-to-a-surface-with-an-opa-policy.md) | Write a Rego policy definition and attach it to a surface, so requests are allowed or denied based on claims, request attributes, and organisational rules. |
| [Roll out an OPA policy globally with monitor-only mode](/products/affinidi-trust-fabric/agent-stream/how-to-guides/policies/roll-out-an-opa-policy-globally.md) | Enforce one policy across every surface of a type, watching what it would deny before it can block any real traffic. |
| [Verify caller credentials with VP evidence](/products/affinidi-trust-fabric/agent-stream/how-to-guides/policies/verify-caller-credentials-with-vp-evidence.md) | Gate a policy on a cryptographically verified issuer and claims, not just a bearer token, without re-implementing verification yourself. |

## Pages in this section
- [Control surface access with an OPA policy](/products/affinidi-trust-fabric/agent-stream/how-to-guides/policies/control-access-to-a-surface-with-an-opa-policy.md): Write a Rego policy definition and attach it to a surface, so requests are allowed or denied based on claims, request attributes, and organisational rules.
- [Roll out an OPA policy globally](/products/affinidi-trust-fabric/agent-stream/how-to-guides/policies/roll-out-an-opa-policy-globally.md): Enforce one policy across every surface of a type, watching what it would deny before it can block any real traffic.
- [Verify caller credentials with VP evidence](/products/affinidi-trust-fabric/agent-stream/how-to-guides/policies/verify-caller-credentials-with-vp-evidence.md): Gate a policy on a cryptographically verified issuer and claims, not just a bearer token, without re-implementing verification yourself.