# OpenFGA vs AuthZed vs Cerbos

Source: https://startwithidentity.com/compare/openfga-vs-authzed-vs-cerbos/
Last updated: 2026-06-19
License: content by Start with Identity. Cite the source URL.

---

## The honest comparison

These three are the names that come up most when teams move authorization out of scattered application code into a dedicated engine. OpenFGA and AuthZed (SpiceDB) implement Google Zanzibar-style relationship-based access control (ReBAC), modeling permissions as relationships between objects. Cerbos takes a different approach: stateless policy-as-code, where you define attribute-based rules and Cerbos evaluates them without storing the relationship graph.

| Dimension | OpenFGA | AuthZed (SpiceDB) | Cerbos |
| --- | --- | --- | --- |
| Model | ReBAC (Zanzibar) | ReBAC (Zanzibar) | Policy-as-code (ABAC/RBAC) |
| State | Stores relationship tuples | Stores relationship tuples | Stateless evaluation |
| Governance | CNCF sandbox (Okta origin) | Commercial (AuthZed) | Open source + commercial (Cerbos Hub) |
| Best for | Fine-grained relationships, Okta ecosystem | Production ReBAC with support | Context-rich, attribute-based decisions |
| Managed option | Via partners/ecosystem | AuthZed Cloud | Cerbos Hub |

## When each wins

- **[OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/):** you want vendor-neutral, CNCF-governed ReBAC, especially alongside Okta/Auth0.
- **[AuthZed](https://startwithidentity.com/vendors/authorization/authzed/):** you want a production-hardened Zanzibar engine with commercial support and a managed service.
- **[Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/):** your decisions are driven by attributes and request context rather than a stored relationship graph, and you prefer stateless policy files in version control.

## Pricing

All three have free open-source cores. AuthZed and Cerbos add managed and enterprise tiers (AuthZed Cloud, Cerbos Hub); OpenFGA is community-driven with managed options through the ecosystem.

## Verdict

If permissions are fundamentally about relationships ("members of this team can edit these docs"), choose a ReBAC engine: OpenFGA for CNCF-neutral open source, AuthZed for commercial backing. If decisions hinge on attributes and context ("managers in the EU region during business hours"), Cerbos fits better and avoids maintaining a relationship store. See [OpenFGA vs Cerbos](https://startwithidentity.com/compare/openfga-vs-cerbos/), [AuthZed vs OpenFGA](https://startwithidentity.com/compare/authzed-vs-openfga/), the [authorization guide](https://startwithidentity.com/guides/authorization/), and the [category](https://startwithidentity.com/vendors/authorization/).