starter.wikiSearch⌘K

Authorization

OpenFGA

Open-source relationship-based authorization engine for evaluating user, object, and relation tuples against versioned models.

Visit official site

Editorial verdict

Choose OpenFGA when permissions are naturally expressed as nested ownership, membership, sharing, and inherited relationships and the team can own model and service operations.12

Best for

  • Products with graph-shaped sharing and ownership
  • Platforms with nested groups or inherited access
  • Teams prepared to operate a focused relationship authorization service
12

Not ideal for

  • Simple application role matrices
  • Teams seeking a managed policy administration product out of the box
  • Rules dominated by arbitrary attributes rather than durable relationships
1
Main trade-off

OpenFGA provides a focused relationship model and check API, but the team owns graph design, tuple integrity, storage, availability, migrations, and operations.12

Product boundary

Decide whether relationship tuples are the correct authorization abstraction and whether the team can operate the service.

OpenFGA evaluates relationship models and tuples; it does not supply authentication, general policy administration, application enforcement, or the domain events that keep tuples correct.1

For: Platform teams with relationship-heavy authorization and explicit self-hosting capability

  • The model reduces to a small stable role matrix
  • Attribute-rich contextual rules dominate
  • A managed administration surface is required
  • The team cannot own tuple consistency and service availability

Why teams consider OpenFGA

  • Relationship-native modelRepresents access through users, objects, relations, and usersets.1
  • Versioned authorization modelsSeparates model definitions from relationship tuples and application code.1
  • Focused check APIEvaluates direct and implied relationships through a dedicated service boundary.1
  • Open-source deploymentCan be deployed in team-controlled infrastructure using documented setup paths.23

Pricing

Open-source software with self-operated infrastructure and engineering cost rather than a stored vendor subscription price.3

Prototype

Open-source software

Prototype with the official distribution while treating the environment as non-production.23

Production

Self-operated service

Budget for compute, datastore, backups, observability, availability, upgrades, model testing, and on-call ownership.23

Vendor fee
No managed OpenFGA price is asserted for this open-source Tool page.23
Real cost
Infrastructure, datastore, engineering, reliability, and model migration are application-team responsibilities.23
Freshness policy
Verify current repository license, release support, and deployment guidance before adoption.23
Pricing checked View official pricing

OpenFGA vs alternatives

Cerbos

Choose when
Prefer policy-as-code and a local PDP across broader policy shapes.
Compared with OpenFGA
Use a different modeling abstraction and policy workflow.57

Permit.io

Choose when
Prefer managed policy administration and delegated authorization UI.
Compared with OpenFGA
Accept a wider managed platform boundary.68

Application-owned authorization

Choose when
Relations and roles remain simple enough to keep explicit in code.
Compared with OpenFGA
The application owns consistency and scale.4

Resources and sources

Understand the model

  • Concepts
    Open
  • Modeling guides
    Open

Operate

  • Docker setup
    Open
  • GitHub repository
    Open

Starter stacks

  1. 1
    OpenFGA concepts

    OpenFGA · Accessed Official

  2. 2
    OpenFGA Docker setup

    OpenFGA · Accessed Official

  3. 3
    OpenFGA license

    OpenFGA · Accessed Official

  4. 4
    NIST Role Based Access Control publications

    NIST · Accessed Official

  5. 5
    Cerbos documentation

    Cerbos · Accessed Official

  6. 6
    Permit.io documentation

    Permit.io · Accessed Official

  7. 7
    Cerbos pricing

    Cerbos · Accessed Official

  8. 8
    Permit.io pricing

    Permit.io · Accessed Official