An open-source, Google Zanzibar-inspired database for storing and querying fine-grained authorization data at scale.
SpiceDB is an open-source authorization database inspired by Google's Zanzibar system. It stores and evaluates fine-grained permissions, allowing applications to check whether a subject (like a user) can perform an action on a resource. It solves the problem of broken access control by providing a scalable, centralized service for managing authorization across complex architectures.
Platform and product teams building microservices or multi-tenant applications that require scalable, fine-grained authorization. It's also suitable for security engineers and developers implementing ReBAC (Relationship-Based Access Control) or ABAC (Attribute-Based Access Control) systems.
Developers choose SpiceDB for its production-proven scalability, faithful Zanzibar implementation, and multi-paradigm flexibility. Its ability to handle millions of queries per second with global consistency, combined with robust tooling for schema safety, makes it a reliable choice for critical authorization workloads.
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Faithful implementation of Google's mature authorization system, providing a proven and scalable foundation for access control, as emphasized in the README.
Combines ReBAC and ABAC with caveated relationships, enabling complex, dynamic policies that adapt to real-world scenarios, as highlighted in the features.
Handles millions of queries per second with billions of relationships at 5ms p95 latency, making it reliable for high-traffic applications, per the README's performance claims.
Includes real-time schema validation and CI/CD integration for secure development, reducing the risk of broken access control in deployments.
Requires deploying and managing a separate database service, adding complexity compared to library-based authorization solutions.
Modeling permissions with the schema language demands understanding Zanzibar concepts, which can be challenging for teams new to relationship-based access control.
Authorization decisions involve network calls to the SpiceDB service, introducing latency and potential single points of failure that embedded logic avoids.