#218
A
Rank #10
OpenFGA
Fine-grained authorization engine implementing Google Zanzibar-style relationship-based access control, now a CNCF project. Standout trait is expressing complex permission models (nested groups, hierarchies) as a queryable relationship graph rather than brittle role lists.
86.3
/ 100
⚙ Full Stack
Go server exposing gRPC/HTTP APIs for authorization checks, backed by a pluggable datastore (PostgreSQL, MySQL, or in-memory for dev). Stateless compute tier with all relationship tuples persisted in the SQL backend.
📈 Scaling Analysis
The Zanzibar-inspired design with stateless check nodes over a sharded relational store is explicitly built for the same authorization-at-Google-scale problem it's modeled on. Read-heavy authorization checks scale horizontally very well; the SQL backend's throughput becomes the eventual ceiling, same as any Zanzibar implementation.
🚀 Running on Nexlayer
Deploy an openfga pod plus a postgres pod at postgres.pod:5432 using Nexlayer's inter-pod DNS convention, pulling both base images via mirror.gcr.io. Since it's a pure backend authorization API with no browser-facing UI, no <% URL %> wiring is needed beyond whatever app consumes its API internally.