Open-source authorization and permission engines in 2026

All open-source authorization and permission engines, ranked

Complete systems you can adopt 1

1. 1
   GrantForge devlive-community

   GrantForge (formerly AuthX) is an open-source (MIT) unified permission platform. It answers two questions in one place: who can do what (functional authorization) and who can see which data (data and field authorization).

   Complete system Usable A Java team needs central RBAC and ABAC with row and field-level rules across several Spring services.

   ★ 106 MIT Java Active, pushed 2 days ago

Building blocks for your own system 12

1. 1
   Casbin apache

   Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

   Building block Production-ready Your application needs configurable permission rules without writing an authorisation engine.

   ★ 20k Apache-2.0 Go Active, pushed today
2. 2
   OPA open-policy-agent

   Open Policy Agent (OPA) is an open source, general-purpose policy engine.

   Building block Production-ready You want one policy language across Kubernetes, CI, APIs and infrastructure, with policies kept outside application code.

   ★ 12k Apache-2.0 Go Active, pushed today
3. 3
   SpiceDB authzed

   Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

   Building block Production-ready Your app needs fine-grained, relationship-based permissions such as sharing, teams and nested folders across services.

   ★ 7.2k Apache-2.0 Go Active, pushed yesterday
4. 4
   CASL stalniy

   CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access

   Building block Production-ready You need the same permission rules in front end and back end of a JavaScript app.

   ★ 7.1k MIT TypeScript Active, pushed today
5. 5
   OpenFGA openfga

   A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

   Building block Production-ready You need fine-grained permissions as a separate service and want a vendor-neutral, CNCF-governed option.

   ★ 6.1k Apache-2.0 Go Active, pushed today
6. 6
   Permify Permify

   An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉

   Building block Usable You want a fine-grained permission service with a readable schema and testing tools.

   ★ 6k AGPL-3.0 Go Active, pushed yesterday
7. 7
   Keto ory

   The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.

   Building block Usable You already use Ory Kratos or Hydra and want permissions from the same stack.

   ★ 5.4k Apache-2.0 Go Active, pushed 2 months ago
8. 8
   Cerbos cerbos

   Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.

   Building block Production-ready You want authorization rules out of application code but do not want to sync relationship data into another database.

   ★ 4.6k Apache-2.0 Go Active, pushed today
9. 9
   Topaz aserto-dev

   Cloud-native authorization for modern applications and APIs

   Building block Usable You want OPA-based policies plus relationship data in one local authorizer.

   ★ 1.4k Apache-2.0 Go Active, pushed 3 days ago
10. 10
    Warrant warrant-dev

    Warrant is a highly scalable, centralized authorization service based on Google Zanzibar. Use it to define, enforce, query, and audit application authorization and access control.

    Building block Usable Only if you already run it; new projects are better served by SpiceDB or OpenFGA.

    ★ 1.3k Apache-2.0 Go Slowing, pushed 11 months ago
11. 11
    Authzed-go authzed

    Official SpiceDB client library for Go

    Building block Production-ready You call SpiceDB from Go services.

    ★ 104 Apache-2.0 Go Active, pushed 39 days ago
12. 12
    Ruek uatuko

    🔐 Lightning fast, global scale authorization service without the overhead of a yet another DSL.

    Building block Experimental Only for experiments with a minimal, fast authorization service.

    ★ 101 Apache-2.0 C++ Slowing, pushed 9 months ago

Developer tools 1

1. 1
   Melange pthm

   OpenFGA-to-PostgreSQL authorization compiler. Generates specialized SQL functions from .fga schemas that query your existing tables. Zero sync, always consistent.

   Developer tool Experimental You like OpenFGA's model but want permission checks inside Postgres without syncing a separate store.

   ★ 107 MIT Go Active, pushed today

Compared head to head

Also under identity providers and single sign-on servers

Open-source licenses

• Permissive: 13. Use it anywhere, including in closed products. You keep the copyright notice; Apache-2.0 also grants patent rights.
• Network copyleft: 1. Like GPL, and running a changed version as a web service counts as distributing it, so its users get the source too.

Languages

Go 11, TypeScript 1, Java 1 and C++ 1.