> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Opal architecture

> Learn about components in Opal's identity management platform.

Use this guide for an overview of Opal's architecture and system components.

![](https://mintcdn.com/opalsecurity/vBw8FkddwxmzMybH/images/docs/architecture-diagram.png?fit=max\&auto=format\&n=vBw8FkddwxmzMybH\&q=85\&s=ac9430e1f0744689178d112874021bbd)

### End user experience

**End users** request access to your resources using Opal's [web UI](https://docs.opal.dev/docs/end-user-faq.md), [Slack](https://docs.opal.dev/integrations/slack.md), [Microsoft Teams](https://docs.opal.dev/integrations/microsoft-teams.md), [Google Chat](https://docs.opal.dev/integrations/google-chat.md), or the [Opal CLI](https://docs.opal.dev/docs/opal-cli.md). AI agents can request access using Opal's [MCP server](https://docs.opal.dev/docs/mcp/overview.md).

### Orchestration layer

In the **Orchestration layer**, admins can:

* Configure [approval workflows](https://docs.opal.dev/docs/configure-reviewers.md) to customize how resources are requested and approved
* Use the [Risk Center](https://docs.opal.dev/docs/least-privilege-posture-management.md) to view insights on anomalous access and proactively remediate vulnerabilities
* Create [user access reviews](https://docs.opal.dev/docs/access-campaigns.md) to streamline compliance
* Use [Access Rules](https://docs.opal.dev/docs/access-rules.md) to assign access to resources based on user attributes (ABAC), enabling Joiner-Mover-Leaver (JML) workflows

### Data fabric layer

The **Data fabric** is composed of an access graph, where Opal tracks and exposes all direct and indirect access paths. Opal's integration catalog lets you easily connect to your [HR, identity, cloud, data, SaaS, and custom systems](https://docs.opal.dev/docs/set-up-connections.md). Custom connections provide the flexibility to combine and connect additional systems.

Remote systems connect to the data fabric layer through a robust **Bidirectional sync**, which propagates all access changes to and from your end systems. Okta, AWS, and Azure also support real-time syncs, so access stays up-to-date.

See individual integrations guides—e.g., [AWS](https://docs.opal.dev/integrations/setting-up-your-aws-organization-in-opal.md) and [GCP](https://docs.opal.dev/integrations/google-cloud-platform.md)—for details on capabilities.

#### Additional data sources

Additionally enrich your user data by syncing attributes from **User directories** and systems of record, such as Okta.

#### On-call schedules

Sync Opal groups with **On-call schedules** pulled from services such as [PagerDuty](https://docs.opal.dev/integrations/pagerduty-oncall.md) and [Opsgenie](https://docs.opal.dev/integrations/opsgenie.md).

### Orchestration tools

To scale and configure your Opal deployment, you can:

* [Set up Terraform](https://docs.opal.dev/docs/use-terraform-with-opal.md) to programmatically manage your Opal configuration and orchestrate your configuration
* Use Opal's [REST API](https://docs.opal.dev/reference/) to connect to Opal objects
* Connect to Opal's [MCP server](https://docs.opal.dev/docs/mcp/overview.md) to allow your AI agents to interact with Opal

### SIEM and logging tools

Opal's integrations with SIEM providers and logging tools allow you to stream Opal events directly to your logging providers, such as DataDog and SumoLogic. Set up [events streaming](https://docs.opal.dev/docs/events-streaming.md) to get started.

### ITSM tools

Opal can connect to your [ticketing providers](https://docs.opal.dev/docs/ticket-propagation.md)–Jira, Linear, or ServiceNow—to propagate access using tickets, create audit tickets, and link requests to existing tickets in Opal.

### Deploy Opal

Deploy Opal with your preferred method:

* Use [Opal Cloud](https://docs.opal.dev/docs/set-up-cloud.md) to quickly connect to Opal's cloud instance
* Set up self-hosted Opal on [AWS EKS](https://docs.opal.dev/docs/self-host-opal-aws-guide.md) or [GKE](https://docs.opal.dev/docs/self-host-opal-gke-guide.md) using [Helm](https://docs.opal.dev/docs/install-opal-using-helm.md) or KOTS to configure deployments
* Configure [airgapped deployments](https://docs.opal.dev/docs/setup-an-airgapped-opal-environment.md) for self-hosted Opal

***


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.