OpenFGA
Open-source fine-grained authorization inspired by Google Zanzibar.
About
OpenFGA is an open-source authorization engine for relationship-based access control (ReBAC), modeled on Google's Zanzibar paper. Developers define an authorization model (users, groups, documents, folders, and their relations) and ask high-throughput check queries like whether a user can access a document through a team and a parent folder. It is maintained by Okta's Auth0 team, with a managed counterpart in Auth0 FGA.
In 2026 industry roundups it consistently ranks as the leading open-source-hedged option for fine-grained authorization, and Okta has extended the line toward AI agents with identity and authorization products for MCP, token vaults, and RAG use cases.
Limitations to note: OpenFGA is ReBAC-first, so attribute-heavy policy problems fit policy-as-code tools better; modeling authorization correctly still requires careful design; and managed pricing is usage-based, so high-check-volume workloads need cost modeling.
What it can do
- Zanzibar-style relationship-based authorization
- High-throughput authorization checks with SDKs
- Open-source core with managed Okta escape hatch
- Model DSL for users, groups, and resource relations
Setup
Run the open-source server via Docker, or use Auth0 FGA as a managed service.
Prerequisites
Understanding of your app's user/resource relationships; a database backend for the self-hosted server.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 83; Trending score 82/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.