OpenFGA

Overview

OpenFGA is a CNCF-hosted, Apache 2.0 licensed authorization engine implementing Google's Zanzibar relationship-based model (ReBAC). It originated at Auth0/Okta and was donated to the CNCF, where it has become the de facto open-source choice for fine-grained, relationship-driven permissions. You define object types and the relations between them, write relationship tuples, and check access with low latency. It is the open community counterpart to AuthZed's SpiceDB, with which it shares the same Zanzibar lineage.

What it is good at

The relationship model is the strength. Hierarchical and shared-resource permissions (folders containing documents, teams owning projects, nested groups) that RBAC struggles with become natural to express. The DSL, visual playground, and SDKs across major languages make modeling approachable, and self-hosting is straightforward backed by Postgres or MySQL. As a CNCF project the licensing and governance are vendor-neutral, which matters for teams that want long-term independence. Pricing transparency is high because the core is simply free and open source.

Where it falls short

As a pure engine it deliberately does nothing on authentication, SSO, or MFA, so those scores are low by design. Governance tooling (audit, change management, collaboration) is thinner than a packaged commercial product unless you buy Okta FGA, the managed offering. Performance at very large tuple counts requires care around store design and caching, and ReBAC is over-engineering if your model is simple RBAC.

Pricing

Free and open source under Apache 2.0 for self-hosting; you own operations. Okta FGA provides a managed, paid version with support and SLAs. Model self-hosted versus managed costs with the TCO calculator.

Best for, and who should look elsewhere

Choose OpenFGA if you need Zanzibar-style ReBAC and are comfortable running infrastructure or paying for the managed version. Compare OpenFGA vs AuthZed for the other Zanzibar engine, OpenFGA vs Cerbos for ReBAC versus policy-as-code, and the three-way OpenFGA vs AuthZed vs Cerbos. See the authorization guide.

Bottom line

The de facto open-source, vendor-neutral choice for Zanzibar-style ReBAC, ideal for teams comfortable operating infrastructure or willing to pay for the managed Okta FGA edition.