OpenFGA
Apache-2.0 Zanzibar-style ReBAC with a Check API
Auth / AuthZ · Apache-2.0 · 5.7k
What's Good
Apache-2.0. Relationship-based access control, Check API, modeling language. Self-host the authorization service. CNCF-flavored ReBAC without inventing your own graph.
The Catch
Zanzibar-style ReBAC + Check API — not Cerbos YAML ABAC. Vs SpiceDB: CNCF/Okta OpenFGA modeling + Check API lane; SpiceDB is AuthZed production Zanzibar + ZedTokens/Cloud. Distinct from Cerbos.
Verdict
Apache-2.0 ReBAC. Self-host free. Not Cerbos YAML.
Embed
[](https://stackgems.com/gems/openfga)