alternatives to
Oso's hosted authorization service, with policies written in its Polar language. A closed product from Oso.
SpiceDB, Permify, Ory Keto and more. 5 alternatives to Oso Cloud, in Go. Compare fit, licence, stars and the latest signed release.
| Tool | Fit | Stars | Licence | Terms | Self-hosted | Language | Latest | Last push |
|---|---|---|---|---|---|---|---|---|
| SpiceDB | Partial | 7.2k | Apache-2.0 | Open source | Yes | Go | v1.56.2 | 2026-10-18 |
| Permify | Partial | 6k | AGPL-3.0 | Open source | Yes | Go | v1.7.5 | 2026-10-15 |
| Ory Keto | Partial | 5.4k | Apache-2.0 | Open source | Yes | Go | v26.2.0 | 2026-09-04 |
| Cerbos | Partial | 4.6k | Apache-2.0 | Open source | Yes | Go | v0.56.0 | 2026-10-19 |
| Topaz | Partial | 1.4k | Apache-2.0 | Open source | Yes | Go | v0.33.22 | 2026-10-14 |
5 alternatives
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
Relationship-based permissions in the style of Google Zanzibar, self-hosted instead of a hosted service.
An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉
Zanzibar-inspired fine-grained permissions on your own infrastructure.
The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.
Zanzibar-style relationship-based permissions, self-hosted and exposed over gRPC and REST.
Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.
Declarative authorization policies evaluated by your own service instead of a hosted one.
Cloud-native authorization for modern applications and APIs
Policies and a relationship directory run on your own infrastructure.