Introducing Ergo: explainable policies on OPA
When an auditor tests a control, they ask two questions about each change: was the control met, and what evidence shows how that result was reached? Most automated controls can answer the first. A Rego policy returns allow: true or allow: false, but says nothing about what it checked. Engineers can hand-write violation messages to explain a failure, but a passing check leaves no record at all. When an auditor asks how a change passed, someone has to reconstruct the answer.
