AuthZed

AuthZed: frequently asked questions

How much does AuthZed cost?

SpiceDB is free to self-host under Apache 2.0. AuthZed Cloud, the managed service, advertises deploying a permissions system for 2 dollars per hour with usage-based billing and standard support included; it is pay-as-you-go with no up-front commitment. AuthZed Dedicated is priced on reserved vCPU capacity after a consultation, and self-hosted enterprise SpiceDB is an annual licence per region and per vCPU, both without published rates. AuthZed prices on compute, not on relationships, checks or monthly active users (checked 2026-11-05).

Is SpiceDB open source and has the licence changed?

SpiceDB is Apache 2.0 and remains so. There has been no relicensing event, no move to BUSL or SSPL, which is worth stating plainly given how many infrastructure projects have changed terms since 2023. The repository carries about 7,200 GitHub stars as of November 2026. SpiceDB Enterprise is a separate commercially licensed build of the same engine rather than a fork, and AuthZed runs it in its own managed services.

What do you lose by running open-source SpiceDB instead of Enterprise?

Four documented capabilities. Restricted API Access scopes which calls each service account may make. Audit Logging emits full request and response detail per API operation to a log sink. Rate Limiting applies distributed limits by endpoint, service account, header or CEL expression, currently marked tech preview. And Security Embargo gives private advance notice of vulnerabilities, with fixes and remediation time before public disclosure. That last one has a real consequence worth weighing: open-source users learn about SpiceDB vulnerabilities at public disclosure, paying customers learn earlier.

Is SpiceDB a true Zanzibar implementation?

It is the closest of the open-source options. SpiceDB implements token-based point-in-time consistency through ZedToken, which its documentation explicitly identifies as the equivalent of Zanzibar's Zookie, and names the New Enemy Problem it exists to prevent. Four consistency modes are exposed per request: minimize_latency, at_least_as_fresh, at_exact_snapshot and fully_consistent. OpenFGA offers an opt-in higher-consistency flag rather than token-based point-in-time consistency. If faithfulness to the Zanzibar paper matters to your design, SpiceDB is the stronger claim.

What is AuthZed Materialize?

Materialize precomputes transitive relationships across the authorization graph, periodically recomputing its view from a snapshot and consuming a live stream of relationship changes in between. It reached general availability on 10 September 2026 for AuthZed Dedicated only, after entering early access in February 2024. AuthZed states single-digit millisecond responses over billions of relationships in production since 2024. Event Streams remains early access; Accelerated Queries is the part that went GA. This is the answer to deeply nested permission graphs where live traversal becomes the bottleneck.

Does SpiceDB have known vulnerabilities?

Several, all patched and none in CISA KEV; the pattern is authorization-logic and log-hygiene bugs rather than remote code execution. CVE-2026-55866 (CVSS 3.7, NVD 14 September 2026) let cached dispatch checks return a full permission where a conditional result was correct; fixed in 1.54.0. CVE-2026-46668 (nested caveat cache reuse, fixed 1.52.0) and CVE-2026-40091 (CVSS 6.0, datastore connection string with password in startup logs, fixed 1.51.1) came earlier in 2026. The latest advisory, GHSA-jf7w-wx43-32gc on 11 September 2026, found traces exposing datastore secrets in 1.54.0 to 1.56.1, fixed in 1.56.2.

What should I check in an AuthZed fine-grained authorization evaluation?

Model your hardest real case in the SpiceDB schema language first: nested folders, group-of-groups sharing, or tenant hierarchies. Then test which consistency mode each call needs, because using fully_consistent everywhere costs latency while minimize_latency risks the New Enemy Problem. Decide early whether you need audit logging, restricted API access or rate limiting, since those are Enterprise-only, and how you will keep relationships in sync with your application database. Finally, check whether Materialize, available only on Dedicated, is needed for deep graphs.

How well funded is AuthZed?

Its last disclosed round was a 12 million dollar Series A announced 27 June 2024, led by General Catalyst with Work-Bench, Y Combinator and Amplify Partners, bringing total raised to 15.9 million dollars. Canva and Turo were named as customers. No funding has been announced since, as of November 2026, so that figure is more than two years old. At the time SpiceDB had more than 4,500 GitHub stars; it has about 7,200 now. AuthZed remains a private company.

What are the best AuthZed alternatives?

OpenFGA, which reached CNCF Incubating maturity in October 2025, if vendor-neutral foundation governance matters more than Zanzibar fidelity. Oso if you want one model spanning roles, relationships and attributes with SQL-level data filtering rather than a relationship database. Cerbos if stateless policy decisions without a central relationship store fit better. Permit.io for a more managed, product-led experience. Stay with SpiceDB when sharing, nesting and hierarchy dominate your permission model and consistency guarantees matter.