openfga/openfga

Health v2 · maintenance only

Adoption not part of the score

5661 stars · 468 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

OpenFGA is a high-performance, open-source fine-grained authorization and permission engine inspired by Google's Zanzibar, owned by the CNCF. It lets developers model relationship-based access control (ReBAC), RBAC, and ABAC via an easy-to-read modeling language and query it through HTTP and gRPC APIs.

Use cases

• check if a user can view or edit a document
• implement role-based access control for my app
• model folder and document parent-child permissions
• centralize authorization decisions outside application code
• list all objects a user has access to
• manage entitlements and permissions for a multi-tenant SaaS
• implement relationship-based access control like Google Zanzibar
• add attribute-based and time-based authorization conditions

When to choose

• you need fine-grained, relationship-based permissions that evolve in complexity
• you want to centralize and audit authorization logic outside your app code
• you need millisecond authorization checks at scale
• you want RBAC, ABAC, and ReBAC in one engine with SDKs for popular languages

When to avoid

• you only need simple role checks that a few database flags can handle
• you cannot operate an external authorization service or datastore
• you need policy-as-code compliance tooling rather than relationship-based permissions

Facets

service · maturity stable

authorization auth security api-framework cli security backend apis developer-tools self-hosted self-hosted go windows cloud zanzibar rebac rbac abac fine-grained-authorization permissions entitlements grpc cncf docker linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="openfga/openfga")