{"data":{"slug":"topaz","name":"Topaz","tagline":"Apache-2.0 authZ: OPA Rego + embedded Zanzibar in one container","category":"nextjs","categoryName":"Next.js","url":"https://www.topaz.sh","github":"https://github.com/aserto-dev/topaz","pricing":"open-source","hook":"Topaz is authorization in one container when you refuse to pick only ABAC or only ReBAC.","whatsGood":"Apache-2.0. OPA Rego policies plus an embedded Zanzibar-style directory in a single binary/container. ABAC and ReBAC without stitching Cerbos to OpenFGA yourself. Self-host is the free path.","theCatch":"One container = OPA Rego + embedded Zanzibar directory (ABAC+ReBAC) — not Cerbos YAML-only PDP and not OpenFGA ReBAC-only Check API. Distinct from Cerbos and OpenFGA.","verdict":"Apache-2.0 combined authZ. Self-host free; not a single-model PDP.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"AuthZ","capabilities":["authz","rego","rebac"],"surfaces":["Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Apache-2.0","githubStars":1361},"related":[{"slug":"vercel","name":"Vercel","tagline":"The platform that made Next.js deployment trivial"},{"slug":"prisma","name":"Prisma","tagline":"Type-safe database access with killer DX"},{"slug":"drizzle","name":"Drizzle ORM","tagline":"TypeScript ORM that feels like SQL"},{"slug":"trpc","name":"tRPC","tagline":"End-to-end typesafe APIs without codegen"},{"slug":"clerk","name":"Clerk","tagline":"Auth that actually ships with your UI"}],"links":{"self":"/api/gems/topaz","html":"/gems/topaz","markdown":"/gems/topaz.md","category":"/api/gems?category=nextjs","categoryPage":"/stacks/nextjs"}}