Every security team fields the same questions. The answer is always: give us a few hours.

An AI-powered query environment embedded directly in Opal

Your security team needs to know exactly which users have direct access to your AWS EC2 instances. In the old world, that's a ticket, an AWS CLI query, and a 2-day wait. In OpalQuery, type the question — and the answer is instant.

An employee just resigned under difficult circumstances. Legal needs every resource they have access to — before they walk out the door. OpalQuery maps the complete access footprint across 79 resources in seconds. Not hours.

Finance Apps hold your most sensitive data. The real question isn't who's a direct member — it's who has any path to get there, through any group, role, or permission chain. OpalQuery traces every route. All 100+ of them.

You need to inventory every admin-level resource in AWS IAM Identity Center before your next access review. OpalQuery lets you search by name — 'contains Admin' returns every admin role, permission set, and Identity Center role in your environment. 12 results, no custom query required.

Patrick is an engineer in your UK office with access to a US-hosted AWS IAM role — a potential data residency violation. OpalQuery cross-references user country tags with resource country tags, surfacing every cross-border exposure before your compliance audit finds it first.

Your auditor wants to know which high-privilege AWS roles are reachable by HR personnel. OpalQuery lets you query from the resource side — find every AWS IAM Role that any HR-tagged user can reach. Two admin roles exposed, two immediate remediation targets confirmed.

ADP holds your employees' salaries, bank accounts, and social security numbers. Access should be tightly scoped to Finance and HR. But engineers in your organization have ADP access — the same system storing every paycheck and tax record. OpalQuery finds every one of them in one query, ready for immediate revocation.

A developer who can also reconfigure your cloud infrastructure can escalate their own permissions, disable logging, or spin up rogue workloads without a second pair of eyes. OpalQuery finds every engineering user with access to an AWS IAM admin role — exposing every SoD violation before your SOC 2 auditor does.

Coupa manages purchase orders. ADP holds payroll and banking data. Anyone with access to both systems can approve spend and manipulate payroll — a financial fraud vector that no single-system review would ever catch. OpalQuery's multi-access-filter approach finds this dangerous intersection in one query.

AI translation, structured filtering, and instant results in a seamless workflow

Read-only queries are just the beginning. The architecture supports action, automation, and policy.