OpenFGA

OpenFGA is a high-performance authorization and permission engine inspired by Google's Zanzibar paper on relationship-based access control. Rather than embedding authorization logic in application code, OpenFGA runs as a standalone service that applications query over HTTP or gRPC APIs to check whether a given user has permission to perform a given action on a given resource, based on a relationship model you define.

It supports multiple storage backends (in-memory, PostgreSQL, MySQL, and SQLite in beta), ships official SDKs for Java, Node.js, Go, Python, and .NET, and includes a CLI, a Terraform provider for configuring servers as code, and a browser-based Playground for modeling and testing authorization rules. It can also be embedded directly as a Go library rather than run as a separate service. OpenFGA is used in production by companies including Auth0, Grafana Labs, Canonical, and Docker.

It's a fit for teams that need fine-grained, relationship-based authorization (for example, nested groups, shared documents, or org-level permissions) as a queryable service, rather than authentication or a simpler role-based access-control library.