aserto-dev/topaz

Health v2 · maintenance only

Adoption not part of the score

1360 stars · 45 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Topaz is an open-source, cloud-native authorization service that provides fine-grained, real-time, policy-based access control for applications and APIs. It combines Open Policy Agent (OPA) as its decision engine with a built-in directory inspired by Google's Zanzibar data model, storing users, groups, objects, and relationships in an embedded local database for fast decisions.

Use cases

• centralize authorization logic instead of scattering it across application code
• implement RBAC, ABAC, or ReBAC access control for APIs and applications
• check if a user has permission to access a document or resource in real time
• deploy an authorizer as a sidecar next to my app for low-latency decisions
• model users, groups, and relationships in a Zanzibar-style directory
• audit and log every authorization decision for compliance
• manage authorization policies as code with signed OCI artifacts

When to choose

• you need fine-grained, real-time authorization (RBAC, ABAC, ReBAC or combinations) for cloud-native apps
• you want to separate authorization logic from application code with a policy-as-code workflow
• you want OPA-style policy rules combined with a Zanzibar-style relationship directory in one self-hosted service
• you need decision logging for audit trails and compliance
• you want SDKs and middleware for Node.js, Go, Python, Java, .NET, or Ruby

When to avoid

• you only need simple role checks that a lightweight in-app library can handle
• you prefer a fully managed hosted authorization service rather than self-hosting
• your stack has no supported SDK and you cannot integrate via gRPC/REST
• you need a solution with no Docker/container runtime dependency, since the authorizer runs as a container

Facets

service · maturity active

authorization auth api-gateway middleware database security backend apis developer-tools self-hosted windows self-hosted go cloud zanzibar opa rbac abac rebac policy-as-code access-control sidecar grpc fine-grained-authorization linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="aserto-dev/topaz")