# oso

Source: https://startwithidentity.com/vendors/authorization/oso/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Overview

Oso provides application authorization built on Polar, its declarative policy language, delivered through Oso Cloud as a managed service that expresses roles, relationships and attributes in a single model. Unlike the policy-as-code tools [Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/) and [Open Policy Agent](https://startwithidentity.com/vendors/authorization/styra-opa/), or the Zanzibar engines [OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/) and [AuthZed](https://startwithidentity.com/vendors/authorization/authzed/), Oso's pitch is one model spanning all three paradigms.

Two changes matter for anyone evaluating it in 2026. The open-source Oso library was deprecated in December 2023, its GitHub repository now titled accordingly, with Oso committing to critical fixes rather than active development. And the company has repositioned around AI agent security: the homepage leads with agent safety, and the published pricing page covers Oso for Agents, while the authorization product, Oso for Apps, carries no public pricing.

## What it is good at

Model breadth and data filtering. Expressing RBAC, ReBAC and ABAC together avoids the usual forced choice, and list filtering means you can authorize queries rather than only single decisions. The documentation is honest about scale boundaries in a way competitors rarely are: centralized filtering is documented as optimal up to roughly 10,000 authorized resources per user, with local filtering generating SQL WHERE clauses against your own database for millions. That SQL pushdown is the strongest technical argument for Oso over a pure relationship engine.

Deployment is flexible, with Cloud, Hybrid (local fallback nodes for availability) and fully self-hosted options. Developer ergonomics, documentation and migration guides are good.

## Where it falls short

The open-source story has weakened considerably. Teams that chose Oso for an embeddable Apache 2.0 engine now face a deprecated library and a proprietary hosted service, which is a meaningful independence problem next to [OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/) under CNCF governance or Cerbos.

Pricing for the authorization product is entirely unpublished, and the company's visible commercial focus has moved to agent security, which raises a fair question about roadmap attention for Oso for Apps.

As an authorization-only tool it does nothing for authentication, SSO or MFA. Compliance is thin: SOC 2 with no stated Type, no ISO 27001, and performance claims that are vendor-asserted rather than audited.

## Pricing

Oso for Agents is published at 0 dollars for 3 users, 15 dollars per user per month up to 25 users, and custom Enterprise. Oso Cloud authorization pricing is not published and requires a sales conversation.

## Best for, and who should look elsewhere

Choose Oso when one unified model across roles, relationships and attributes plus database-level filtering fits the problem, and hosted dependency is acceptable. Choose [AuthZed](https://startwithidentity.com/vendors/authorization/authzed/) or OpenFGA for Zanzibar-style relationship authorization at scale, or [Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/) for stateless policy decisions. See [OpenFGA vs Cerbos](https://startwithidentity.com/compare/openfga-vs-cerbos/).

## Bottom line

A capable unified authorization model with genuinely useful SQL-level filtering, now sold by a company whose public attention has moved to AI agent security.