# aserto-dev/topaz

Cloud-native authorization for modern applications and APIs

Repository: https://github.com/aserto-dev/topaz
Canonical: https://ross.abutalabs.com/products/topaz
Homepage: https://www.topaz.sh
Language: Go
License: Apache-2.0
License Family: permissive
Topics: access-control, authorization, cloud-native, abac, api, rbac, rebac, zanzibar, opa, golang, security
Last push: 2026-08-25T17:42:59+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 99, longevity 100
- inputs: {"age_days": 1410, "days_push": 8, "days_rel": 7, "gap_med": 7.0, "n_releases_24m": 57}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1360, forks 45 (observed 2026-08-28T04:04:29.875198+00:00)

## What it is
Topaz is an open-source, cloud-native authorization service that provides fine-grained, real-time, policy-based access control for applications and APIs. It combines Open Policy Agent (OPA) as its decision engine with a built-in directory inspired by Google's Zanzibar data model, storing users, groups, objects, and relationships in an embedded local database for fast decisions.

## Use cases
- centralize authorization logic instead of scattering it across application code
- implement RBAC, ABAC, or ReBAC access control for APIs and applications
- check if a user has permission to access a document or resource in real time
- deploy an authorizer as a sidecar next to my app for low-latency decisions
- model users, groups, and relationships in a Zanzibar-style directory
- audit and log every authorization decision for compliance
- manage authorization policies as code with signed OCI artifacts

## When to choose
- you need fine-grained, real-time authorization (RBAC, ABAC, ReBAC or combinations) for cloud-native apps
- you want to separate authorization logic from application code with a policy-as-code workflow
- you want OPA-style policy rules combined with a Zanzibar-style relationship directory in one self-hosted service
- you need decision logging for audit trails and compliance
- you want SDKs and middleware for Node.js, Go, Python, Java, .NET, or Ruby

## When to avoid
- you only need simple role checks that a lightweight in-app library can handle
- you prefer a fully managed hosted authorization service rather than self-hosting
- your stack has no supported SDK and you cannot integrate via gRPC/REST
- you need a solution with no Docker/container runtime dependency, since the authorizer runs as a container

## Facets
- artifact type: service
- maturity: active
- function: authorization, auth, api-gateway, middleware, database
- domain: security, backend, apis, developer-tools, self-hosted
- platform: windows, self-hosted, go, cloud
- tags: zanzibar, opa, rbac, abac, rebac, policy-as-code, access-control, sidecar, grpc, fine-grained-authorization, linux, macos, docker

## Member repositories
- aserto-dev/topaz (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:29.875198+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:41:38.026378+00:00, confidence not recorded.
  - readme: https://github.com/aserto-dev/topaz (fetched 2026-08-28T04:04:29.875198+00:00, sha a902a3aed353)
  - homepage: https://www.topaz.sh (fetched 2026-08-29T11:59:32.855318+00:00, sha c49445b5fcfb)
  - site_page: https://www.topaz.sh/docs/intro (fetched 2026-08-29T11:59:32.864502+00:00, sha 32e0f22e4fbf)
  - site_page: https://www.topaz.sh/docs/getting-started (fetched 2026-08-29T11:59:32.866550+00:00, sha edc57e8c70f1)
  - site_page: https://www.topaz.sh/docs/software-development-kits/javascript/express (fetched 2026-08-29T11:59:32.868418+00:00, sha dfe4daddb180)
  - site_page: https://www.topaz.sh/docs/software-development-kits/go/install (fetched 2026-08-29T11:59:32.870593+00:00, sha 6f82cf84146c)
  - site_page: https://www.topaz.sh/docs/software-development-kits/python/api-client (fetched 2026-08-29T11:59:32.872597+00:00, sha 038e8dbc64c1)
  - site_page: https://www.topaz.sh/docs/software-development-kits/java/authorizer (fetched 2026-08-29T11:59:32.874342+00:00, sha 64677885b676)
  - site_page: https://www.topaz.sh/docs/software-development-kits/dotnet/dotnetcore (fetched 2026-08-29T11:59:32.875907+00:00, sha 0b8057bb4e81)
  - site_page: https://www.topaz.sh/docs/software-development-kits/ruby/middleware (fetched 2026-08-29T11:59:32.877785+00:00, sha 4088c5d504cc)
- Data as of 2026-08-30T08:39:29.467469+00:00.