Topaz
An open-source authorization service providing fine-grained, policy-based access control for cloud-native applications and APIs.
What is Topaz?
Topaz is an open-source authorization service that provides fine-grained, policy-based access control for modern applications and APIs. It centralizes authorization logic using the Open Policy Agent (OPA) as its decision engine and includes a built-in directory for modeling domain data. It solves the problem of scattered authorization code by offering a unified, real-time service that supports RBAC, ABAC, and ReBAC models.
Developers and security engineers building cloud-native applications, microservices, or APIs who need a scalable, centralized authorization solution with flexible policy management.
Developers choose Topaz for its integration with OPA, built-in Zanzibar-inspired directory, and ability to deploy as a sidecar or microservice for low-latency decisions. It offers a comprehensive, self-hosted alternative to proprietary authorization services with strong policy-as-code and auditing capabilities.
Overview
Cloud-native authorization for modern applications and APIs
Use Cases
Best For
- Implementing centralized authorization for microservices architectures
- Enforcing fine-grained access control in multi-tenant SaaS applications
- Managing policy-as-code for compliance and audit requirements
- Building applications that require real-time, low-latency authorization decisions
- Transitioning from simple RBAC to more complex ABAC or ReBAC models
- Securing APIs with dynamic, relationship-based access policies
Not Ideal For
- Applications with basic, unchanging role-based permissions that don't require dynamic or fine-grained control
- Teams already using all-in-one identity platforms (e.g., Auth0, Okta) with built-in authorization that meets their needs
- Real-time systems where sub-millisecond latency is critical and any network call to an external service is prohibitive
- Projects without container or microservices infrastructure, as Topaz is designed for cloud-native deployments
Pros & Cons
Pros
Enables separation of concerns by allowing security engineers to manage authorization policies as code separately from application logic, as highlighted in the 'Authorization in one place' benefit.
Supports evolving from simple RBAC to complex ABAC or ReBAC models, providing adaptability as application needs grow, mentioned in the 'Flexible authorization model' section.
Includes a Zanzibar-inspired directory for modeling domain objects and relationships stored locally, facilitating fast, relationship-based access control decisions.
Can be deployed as a sidecar or microservice for high availability and fast response times, as emphasized in the 'Blazing fast' benefit.
Logs every authorization decision to support audit trails, compliance, and forensic analysis, a key feature listed in the benefits.
Cons
The quickstart involves multiple steps like Docker installation, template setup, and configuration, which can be daunting for newcomers without prior infrastructure experience.
Requires learning and maintaining OPA policies in the Rego language, adding a learning curve and potential barrier for teams unfamiliar with policy-as-code practices.
As a self-hosted service, it necessitates managing certificates, databases, and deployment, increasing DevOps burden compared to managed authorization solutions.
Frequently Asked Questions
Related Projects
spicedbOpen Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
PermifyAn open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉
Open Policy Administration LayerPolicy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)
WarrantWarrant is a highly scalable, centralized authorization service based on Google Zanzibar. Use it to define, enforce, query, and audit application authorization and access control.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.