authzed/spicedb

Health v2 · maintenance only

Adoption not part of the score

6990 stars · 413 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

SpiceDB is an open-source, Google Zanzibar-inspired database for storing, computing, and validating fine-grained authorization data at scale. It exposes gRPC and HTTP APIs for defining permission schemas, writing relationships, and checking access, and deploys via Docker or a Kubernetes operator.

Use cases

• implement fine-grained permissions for my application
• replace hardcoded role checks with a centralized authorization service
• model RBAC and ReBAC relationships like Google Zanzibar
• check if a user can access a resource via an API
• secure multi-tenant RAG pipelines and AI agents
• manage entitlements and access control lists at scale
• migrate from Open Policy Agent to relationship-based authorization

When to choose

• you need scalable, centralized fine-grained authorization across many services
• your permission model involves nested or recursive relationships (teams, hierarchies, sharing)
• you want a battle-tested Zanzibar implementation with strong consistency guarantees
• you need authorization for multi-tenant or AI/RAG workloads

When to avoid

• you only need simple role checks that fit in application code
• you want authentication or identity management rather than authorization
• you cannot operate an additional stateful datastore and its backing database
• your access rules are purely attribute-based policies better suited to OPA-style policy engines

Facets

service · maturity stable

authorization database rpc api-framework security databases backend developer-tools large-language-models windows go cloud self-hosted zanzibar fine-grained-authorization rebac rbac abac permissions entitlements fga grpc access-control multi-tenant rag-authorization linux macos docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="authzed/spicedb")