# authzed

Source: https://startwithidentity.com/vendors/authorization/authzed/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Overview

AuthZed builds SpiceDB, the open-source authorization database inspired by Google's Zanzibar paper, plus a managed cloud, a dedicated offering and a commercial self-hosted build. It is a relationship-based access control engine: permissions are modelled as a graph of relationships between subjects and objects, and checks traverse that graph. Founded in 2020, it raised a [12 million dollar Series A](https://authzed.com/blog/series-a-funding) led by General Catalyst in June 2024, bringing total funding to 15.9 million dollars, with Canva and Turo as named customers.

SpiceDB is Apache 2.0 and has stayed that way, with roughly 7,100 GitHub stars and a current release of v1.56.2 from September 2026.

## What it is good at

Zanzibar fidelity and operational maturity. SpiceDB models nested ownership, sharing, groups and hierarchies that flat RBAC cannot express, and its consistency controls are the strongest argument for it: ZedToken is the documented equivalent of Zanzibar's Zookie, with four per-request consistency modes from minimize_latency through fully_consistent, explicitly addressing the New Enemy Problem where stale permission data leaks access. [OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/) offers a coarser opt-in consistency flag by comparison.

Pricing structure is a quiet advantage. AuthZed meters on compute capacity, by vCPU and region, rather than per relationship or per check, so storing more permission facts does not itself increase cost. AuthZed Cloud starts at 2 dollars per hour with no annual commitment.

Materialize reached general availability in September 2026 on the Dedicated tier, precomputing transitive relationships for deeply nested graphs where live traversal is too slow.

## Where it falls short

Four capabilities are reserved to SpiceDB Enterprise: restricted API access, audit logging, rate limiting and Security Embargo. That last one means open-source users receive vulnerability detail only at public disclosure while paying customers get advance notice, which is a real consideration for self-hosters.

Funding is over two years stale with no announced Series B, and no customer count is published beyond two named logos.

The CVE record is honest but non-trivial, including a September 2026 cache-key flaw that could return a full permission grant where a conditional result was correct, and two separate incidents of datastore passwords written to logs.

As an authorization engine it does nothing for authentication, SSO or MFA, and relationship modelling has a genuine learning curve.

## Pricing

SpiceDB free under Apache 2.0. AuthZed Cloud from 2 dollars per hour, hourly metered. SpiceDB Enterprise and Dedicated are quoted, priced on region and reserved vCPU. Model it with our [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose AuthZed when sharing, nesting and hierarchy dominate your permission model and you need consistency guarantees. Choose [OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/) for CNCF governance, [Oso](https://startwithidentity.com/vendors/authorization/oso/) for a unified model with SQL filtering, or [Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/) for stateless policy decisions. See [OpenFGA vs AuthZed vs Cerbos](https://startwithidentity.com/compare/openfga-vs-authzed-vs-cerbos/).

## Bottom line

The most faithful open-source Zanzibar implementation available, with capacity-based pricing that does not punish scale, provided you can live with Enterprise-gated audit logging and embargoed security disclosures.