A microservice architecture that accommodates the heterogeneity of various development environments and enables flexible maintenance can secure business agility to manage services in line with rapidly changing requirements. Due to the nature of MSA, where communication between microservices within a service is frequent, the boundary security that has been used in the past is not sufficient in terms of security, and a Zerotrust system is required. In addition, as the size of microservices increases, definition of access control policies according to the API format of each service is required, and difficulties in policy management increase, such as unnecessary governance overhead in the process of redistributing services. In this paper, we propose a microservice architecture that centrally manages policies by separating access control decision and enforcement with a general-purpose policy engine called OPA (Open Policy Agent) for collective and flexible policy management in Zerotrust security-applied environments.