# Topaz

> Apache-2.0 authZ: OPA Rego + embedded Zanzibar in one container

**Category:** Next.js  
**Pricing:** open-source  
**URL:** https://www.topaz.sh  
**GitHub:** https://github.com/aserto-dev/topaz  
**Added:** 2026-09-04

---

## The Hook

Topaz is authorization in one container when you refuse to pick only ABAC or only ReBAC.

## What's Good

Apache-2.0. OPA Rego policies plus an embedded Zanzibar-style directory in a single binary/container. ABAC and ReBAC without stitching Cerbos to OpenFGA yourself. Self-host is the free path.

## The Catch

One container = OPA Rego + embedded Zanzibar directory (ABAC+ReBAC) — not Cerbos YAML-only PDP and not OpenFGA ReBAC-only Check API. Distinct from Cerbos and OpenFGA.

## Verdict

Apache-2.0 combined authZ. Self-host free; not a single-model PDP.