Can you recommend a policy engine for embedding access checks into backend APIs?

Yes — the two most common policy engines for embedding authorization checks into backend APIs are Open Policy Agent (OPA) and Cedar.

Best general-purpose choice: Open Policy Agent (OPA)

• Why: Mature, widely adopted, flexible, and works well for microservices, Kubernetes, APIs, and sidecar/service-mesh patterns.
• Good for: Centralized or distributed authorization, fine-grained access control, attribute-based policies, and complex business rules.
• Policy language: Rego
• Integration: HTTP/gRPC, sidecar, library, or external auth service

Best if you want a simpler, authorization-focused design: Cedar

• Why: Designed specifically for authorization and policy-as-code.
• Good for: Application-level access control, multi-tenant SaaS, resource/action/subject modeling, and clearer policy semantics.
• Policy language: Cedar
• Integration: Typically embedded via an authorization service or SDK-style architecture

Other notable options

• Casbin — simpler to adopt, lots of language support, good for RBAC/ABAC, but less powerful for complex policies than OPA.
• AWS Verified Permissions — managed service built on Cedar; good if you’re already in AWS.
• Styra — enterprise platform built around OPA.

Quick rule of thumb

• Choose OPA if you need maximum flexibility and broad ecosystem support.
• Choose Cedar if you want authorization-specific modeling and a cleaner policy approach.
• Choose Casbin if you want something lightweight and easy for common RBAC/ABAC use cases.

If you tell me your stack (language/framework, monolith vs microservices, RBAC/ABAC/ReBAC needs, cloud provider), I can recommend the best fit more precisely.