AuthZed SpiceDB

SpiceDB is an open source permissions database from AuthZed, built on the model Google described in its Zanzibar paper. It stores relationships between subjects and resources and answers permission questions against them, rather than evaluating rules written per application.

The relationship based model is what distinguishes it from role based systems and it handles a problem those systems handle badly. Real permissions are frequently relational: a user may edit a document because they belong to a team that owns a folder containing it. Expressing that as roles means enumerating combinations that multiply as the hierarchy grows, whereas storing relationships and traversing them answers the question directly however deep the nesting goes.

Consistency matters more here than the model suggests, and it is why Zanzibar was a notable paper rather than an obvious design. A permissions system that returns stale answers will allow access that was just revoked, so the guarantees offered around freshness are a substantive part of what the database provides.

AuthZed offers SpiceDB as open source alongside managed cloud hosting, with a self service tier priced by the hour and dedicated and enterprise options above it. That combination lets a team adopt the open source engine and move to managed hosting without changing the model.