OpenFGA

OpenFGA is an open source fine grained authorization solution letting developers build granular access control through a modelling language the project describes as easy to read, backed by straightforward APIs. It is a Cloud Native Computing Foundation project and, like SpiceDB, draws on the relationship based approach Google described in its Zanzibar paper.

Readability of the model is the claim the project leads with, and it is a more meaningful goal than it first sounds. An authorization model is a security control, and a control nobody outside the implementing team can read cannot be reviewed by the people responsible for approving it. If a security lead or an auditor can read the model directly, review becomes possible without a translation step in which errors hide.

Relationship based authorization handles hierarchical and inherited permissions natively, so access granted through team membership or folder ownership is expressed as a relationship rather than enumerated as roles that multiply with every level of nesting.

Getting started is deliberately quick, with the project publishing a single Docker command to run a local instance. Being CNCF hosted and open source removes both licence cost and the question of what happens to the project if a vendor changes direction.