Top 7 Open-Source Authorization Tools

Authorization, deciding what an authenticated user is allowed to do, is often buried in scattered if statements across an application, which makes permissions inconsistent, hard to audit, and risky to change. Open-source authorization tools externalize that logic into a dedicated policy engine or library, so access decisions are centralized, testable, and changeable without redeploying every service. For teams building fine-grained permissions, multi-tenancy, or complex sharing models, these tools have become foundational infrastructure.

The field splits along two lines. First, the policy model: relationship-based access control (ReBAC) in the Google Zanzibar tradition, versus attribute- and policy-based approaches (ABAC and policy-as-code), versus classic role-based access control (RBAC). Second, the deployment shape: a standalone authorization service you call over the network, versus a library you embed in your application. This guide evaluates the seven open-source authorization tools worth knowing in 2026 across both dimensions. For the concept, see our authentication vs authorization fundamentals, and for the broader landscape, the top open-source IAM solutions.

Evaluation Criteria

We assessed each tool against the following dimensions:

• Policy model, ReBAC, ABAC, RBAC, or policy-as-code
• Deployment shape, standalone service vs embedded library
• Performance and consistency, latency, throughput, and consistency guarantees
• Developer experience, modeling language, SDKs, testing tools
• Scale, suitability for large, multi-tenant, fine-grained permission sets
• Deployment, self-hosting complexity, Docker, Kubernetes, HA
• Community and support, activity, governance, commercial options

Authorization service or authorization server?

These are different products and the words are used interchangeably almost everywhere, which sends a lot of buyers to the wrong category.

An authorization server is an OAuth 2.0 and OIDC component. It authenticates a user and issues tokens: access tokens, refresh tokens, ID tokens. Keycloak, Ory Hydra, Auth0 and Microsoft Entra are authorization servers. If you need login, consent screens and token issuance, that is what you are shopping for, and none of the tools on this page do it.

An authorization service, sometimes called a policy engine or a permissions service, decides what an already-authenticated principal may do with a specific resource. Can Alice edit document 42? Every tool on this page answers that question, and none of them issues tokens.

Most production systems need both, and they sit at different points in the request path. If you arrived here wanting an OAuth token issuer, see the top open-source IAM solutions instead.

Self-hosted, managed service, or embedded library

The second question is where the decision engine actually runs, and it changes the operational cost more than the choice of vendor does.

Self-hosted service. Run OpenFGA, SpiceDB, Cerbos or Ory Keto yourself as a network service. Full control, no per-request vendor cost, and you own availability and upgrades. This is what most teams mean by an open-source authorization service.

Managed service. Several of the same engines are sold as hosted products: AuthZed Cloud for SpiceDB, Cerbos Hub, Ory Network for Keto, and Oso Cloud. You give up control and take on a dependency, and in exchange you stop operating a latency-critical service. AuthZed Cloud publishes a starting figure of 2 dollars per hour; most of the others quote.

Embedded library. Evaluate in-process, no network hop, lowest possible latency. Casbin is the remaining strong open-source option here. Note that the original Oso library, long the other answer, was deprecated in December 2023.

A practical rule: if your authorization check sits in a hot path measured in single-digit milliseconds, an embedded library or a local sidecar beats a remote call regardless of which engine is behind it.

The Top 7 Open-Source Authorization Tools

1. OpenFGA

Best For: Teams that want Zanzibar-style relationship-based authorization as a service, under neutral governance.

Overview

OpenFGA is a Cloud Native Computing Foundation project implementing Google Zanzibar-style relationship-based access control. Originally built at Auth0, it was donated to the CNCF and is now vendor-neutral. You model your domain as types and relations, write relationship tuples, and query whether a user has a permission on an object; OpenFGA resolves the answer through the relationship graph. It is a strong fit for fine-grained, multi-tenant permissions such as document sharing, hierarchical resources, and org structures, with SDKs across major languages and a modeling language (DSL) that makes authorization models readable.

Key Features

• Zanzibar-style ReBAC with a readable modeling DSL
• Relationship tuples and contextual checks
• CNCF governance and vendor neutrality
• SDKs across major languages and a HTTP/gRPC API
• Playground for modeling and testing authorization

License Apache 2.0 (true open source), under the CNCF.

Pros

• Neutral, community-governed Zanzibar implementation
• Clean modeling language and good developer tooling
• Strong fit for fine-grained, multi-tenant permissions

Cons

• Running it as a highly available service takes effort
• ReBAC modeling has a learning curve
• You operate the store and tune performance yourself

---

2. SpiceDB (AuthZed)

Best For: Teams that need Zanzibar-style authorization with strong consistency at scale.

Overview

SpiceDB is an open-source Zanzibar-inspired database for permissions, built by AuthZed. Like OpenFGA it models permissions as relationships, but it emphasizes Zanzibar's consistency model closely, including support for consistency tokens (Zookies) that prevent the "new enemy" problem where stale permission data leaks access. SpiceDB is designed for scale and correctness, with a schema language, a powerful API, and tooling for testing and validation. AuthZed offers a managed cloud and enterprise features, while SpiceDB itself is open-source.

Key Features

• Zanzibar-faithful ReBAC with strong consistency (Zookies)
• Schema language and relationship-based permissions
• Designed for high scale and correctness
• gRPC and HTTP APIs with multi-language clients
• Validation and testing tooling

License Apache 2.0 (true open source); AuthZed Cloud and enterprise are paid.

Pros

• Closest to Zanzibar's consistency guarantees
• Built for scale and correctness-sensitive use cases
• Strong schema and testing tooling

Cons

• Consistency features add conceptual complexity
• Operating at scale requires database expertise
• Advanced features and support sit in the paid tiers

---

What changed in 2026 AuthZed Materialize reached general availability on 10 September 2026 for AuthZed Dedicated, precomputing transitive relationships for deeply nested permission graphs where live traversal becomes the bottleneck. Worth knowing before self-hosting: four capabilities are reserved to the commercial SpiceDB Enterprise build, including audit logging and Security Embargo, the last meaning open-source users receive vulnerability detail only at public disclosure while paying customers get advance notice. SpiceDB itself remains Apache 2.0 with no relicensing.

3. Oso

Best For: Teams that want one policy model across roles, relationships and attributes, and are willing to depend on a hosted service.

Overview

Oso built its reputation on Polar, a declarative policy language expressing RBAC, ABAC and relationship-based rules in one model, originally shipped as an Apache 2.0 library you embedded in your application. That library is now deprecated. The osohq/oso repository carries the title "Deprecated: See README", with the deprecation dating to December 2023; Oso states it will continue critical fixes and has said a future open-source release is planned, but active development moved to the proprietary, hosted Oso Cloud. The company has also repositioned around AI agent security: its published pricing page now covers Oso for Agents, while Oso Cloud authorization carries no public pricing. Include it for the strength of the policy model and the SQL-level data filtering, not as an open-source library to adopt today.

Key Features

• Embeddable authorization with the Polar policy language
• Supports RBAC, ABAC, and relationship-based rules
• In-process evaluation for low latency
• Integrations for popular application frameworks
• Hosted Oso Cloud is the actively developed product; the open-source library is deprecated

License Open-source library (Apache 2.0); Oso Cloud is a paid service.

Pros

• No separate service to operate for the embedded model
• Expressive, purpose-built policy language
• Flexible across RBAC, ABAC, and ReBAC patterns

Cons

• Embedded model means per-service policy distribution
• Polar is another language for the team to learn
• Centralized, cross-service needs push you toward the paid cloud

---

4. Cerbos

Best For: Teams wanting stateless, policy-as-code authorization decoupled from application code.

Overview

Cerbos is an open-source, stateless authorization service that evaluates access decisions from policies written in YAML. You send the principal, the resource, and the action, and Cerbos returns an allow or deny based on your policies, without storing relationship data itself, which keeps it simple to operate and easy to scale horizontally. Cerbos suits ABAC and RBAC use cases where decisions can be made from the attributes provided at request time, and it integrates cleanly into microservices. For relationship-heavy models it is a weaker fit than the Zanzibar tools.

Key Features

• Stateless decision service with YAML policies
• ABAC and RBAC with contextual conditions
• Policy testing and audit tooling
• Horizontal scaling with no shared state
• gRPC and HTTP APIs with multi-language SDKs

License Apache 2.0 (true open source); Cerbos Hub is a paid managed option.

Pros

• Simple to operate; stateless and horizontally scalable
• Human-readable YAML policies with built-in testing
• Clean fit for microservice architectures

Cons

• Not designed for relationship-based, Zanzibar-style models
• You supply the attributes; no relationship store
• Complex sharing graphs are a poor fit

---

5. Open Policy Agent (OPA)

Best For: Teams wanting one policy engine across infrastructure and applications.

Overview

Open Policy Agent is a CNCF graduated project and the de facto standard for policy-as-code across cloud-native infrastructure. It uses Rego, a declarative policy language, to make decisions for Kubernetes admission control, microservice authorization, API gateways, CI/CD, and more. Styra, the company behind OPA, offers a commercial control plane (Styra DAS) for managing policies at scale. OPA is general-purpose: it can do application authorization, but its center of gravity is infrastructure and platform policy, and Rego has a reputation for a steep learning curve.

Key Features

• General-purpose policy engine with the Rego language
• Kubernetes admission control and infrastructure policy
• Application and API authorization
• Decision logging and bundle distribution
• Broad ecosystem and CNCF graduation

License Apache 2.0 (true open source); Styra DAS is a commercial control plane.

Pros

• One policy engine spanning infra and applications
• Mature, widely adopted, CNCF graduated
• Strong ecosystem and integrations

Cons

• Rego has a steep learning curve
• Not relationship-based; heavy fine-grained models are awkward
• Managing policies at scale often needs the commercial control plane

---

6. Ory Keto

Best For: Teams already using the Ory stack that want Zanzibar-style permissions.

Overview

Ory Keto is the permissions component of the open-source Ory stack and one of the first open-source implementations of Google Zanzibar. It stores relationship tuples and answers permission checks over gRPC and HTTP, and it pairs naturally with Ory Kratos for identity and Ory Hydra for OAuth 2.0. Keto is a strong choice for teams already invested in Ory who want relationship-based authorization from the same ecosystem, though as a component it is most compelling in that context rather than as a standalone pick against OpenFGA or SpiceDB.

Key Features

• Zanzibar-style relationship-based permissions
• gRPC and HTTP APIs
• Integrates with Ory Kratos and Ory Hydra
• Namespaces for organizing permission models
• Cloud-native, horizontally scalable

License Apache 2.0 (true open source); Ory Network is a paid managed service.

Pros

• Native fit with the broader Ory identity stack
• Early, proven Zanzibar implementation
• Consistent operational model with other Ory components

Cons

• Most compelling only within the Ory ecosystem
• Smaller standalone community than OpenFGA or SpiceDB
• Fewer modeling conveniences than the dedicated leaders

---

7. Casbin

Best For: Teams wanting a flexible, embeddable authorization library across many languages.

Overview

Casbin is a widely adopted open-source authorization library available in many languages, from Go and Java to Node.js and Python. It uses a configurable model based on the PERM metamodel (policy, effect, request, matchers), which lets it express RBAC, ABAC, and other patterns by changing a model configuration rather than code. Casbin is embedded in-process and reads policies from files or databases, making it a pragmatic choice for teams that want proven, flexible authorization without operating a service. It is less specialized than the Zanzibar engines for deep relationship graphs, but its breadth and language coverage are unmatched.

Key Features

• Embeddable library across many languages
• Configurable PERM model for RBAC, ABAC, and more
• Policy storage adapters for databases and files
• Large community and long track record
• Role hierarchies and domain/tenant support

License Apache 2.0 (true open source).

Pros

• Broadest language coverage of any tool here
• Flexible model configuration without code changes
• Mature and widely deployed

Cons

• In-process library, not a centralized service
• Deep relationship models are better served by Zanzibar tools
• Consistency and distribution are your responsibility

---

How to Choose

Start with the policy model. For fine-grained, relationship-based permissions in the Google Zanzibar tradition, OpenFGA and SpiceDB lead, with OpenFGA offering neutral CNCF governance and SpiceDB the closest fidelity to Zanzibar's consistency guarantees; choose Ory Keto if you already run the Ory stack. For policy-as-code, Cerbos is the simplest stateless decision service, and Open Policy Agent via Styra is the standard when you want one engine across infrastructure and applications. For an embedded library, Oso offers an expressive policy language and Casbin offers the widest language coverage.

Then decide service versus library: a standalone service centralizes policy and suits many teams and services, while an embedded library keeps latency low and deployment simple for a single application. Whichever you choose, the value is the same, moving authorization out of scattered code into a consistent, auditable model. For the underlying concepts, see RBAC vs ABAC vs ReBAC, and compare specific pairs like OpenFGA vs AuthZed vs Cerbos in our comparisons.

The open-source identity landscape

This is one of a series covering open-source tooling across every identity category:

• Open-source IAM solutions
• Open-source CIAM platforms
• Open-source IGA tools
• Open-source PAM solutions
• Open-source MFA and passwordless tools
• Open-source secrets management
• Open-source password managers
• Open-source zero trust and ZTNA tools
• Open-source machine and workload identity
• Open-source PKI and certificate management
• Open-source directory services and LDAP servers
• Open-source Active Directory security tools
• Open-source decentralized identity tools
• Open-source cloud entitlement and CIEM tools
• Open-source secrets scanning and NHI tools