Authorization & policy

Open Policy Agent

open-policy-agent/opa

Popular

CNCF-graduated general-purpose policy engine (OPA) using Rego for Kubernetes, APIs, CI and IaC.

OpenFGA

openfga/openfga

Rising

CNCF Zanzibar-inspired relationship-based (ReBAC) authorization engine created by Auth0/Okta.

SpiceDB

authzed/spicedb

Rising

Google Zanzibar-style permissions database from AuthZed for relationship-based access at scale.

Casbin

apache/casbin

Apache authorization library supporting ACL, RBAC and ABAC models, with ports for Go, Node, Python, Java and more.

Cerbos

cerbos/cerbos

Stateless, self-hosted authorization engine with YAML policies for RBAC/ABAC from any language.

Cedar

cedar-policy/cedar

Trending (detected automatically)Rising

AWS's open-source policy language and engine with formal verification; powers Amazon Verified Permissions.

Permify

Permify/permify

Open-source Zanzibar-inspired authorization service for fine-grained, relationship-based permissions.

Oso

osohq.com

Managed authorization service (Oso Cloud) using the Polar language for RBAC, ReBAC and ABAC in apps.

Permit.io

permit.io

Authorization-as-a-service with a policy UI on top of OPA, Cedar and OpenFGA engines.