OpenFGA

⁠OpenFGA is an open-source, fine-grained authorization system inspired by Google’s Zanzibar. It models relationships between users and resources to determine permissions, enabling applications to answer questions such as “Can this user access this resource?”

Unlike traditional role-based access control (RBAC), OpenFGA supports complex, resource-specific permissions and hierarchical relationships. It centralizes authorization logic, improving maintainability, consistency, testing and auditing across distributed services.

We’ve successfully used OpenFGA in production for sophisticated relationship-based access control (ReBAC), deploying it with a sidecar strategy to enable low-latency permission checks. It’s a compelling choice when standard RBAC becomes insufficient.