License & Deployment Mix: 17 tools – 13 OSS, 3 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
Overview
Policy engines decouple authorization decisions from application code. They evaluate requests against policies defined as code, relationships, or rules, returning permit/deny decisions that applications enforce. This category covers standalone policy platforms – not the policy features built into directory services (see Directory Services) or identity providers (see IAM & Identity Governance (IGA)).
Sub-Categories
The landscape divides into distinct groups:
- General policy engines – language-agnostic policy evaluation (OPA/Rego, Cedar)
- Kubernetes admission controllers – K8s- specific policy enforcement (Gatekeeper, Kyverno)
- Zanzibar-inspired ReBAC – relationship- based permissions at scale (SpiceDB, OpenFGA, Permify, Ory Keto)
- Application authorization PDPs – stateless or embedded decision points (Cerbos, Topaz, Casbin)
- Authorization-as-a-service – managed SaaS platforms (Permit.io, Oso, Styra DAS)
- Policy administration – real-time policy and data distribution (OPAL)
Key Capabilities
- Policy-as-code – policies defined in declarative languages (Rego, Cedar, YAML, Polar) versioned in Git
- Authorization models – RBAC, ABAC, ReBAC, PBAC, ACL, or hybrid models
- Policy Decision Point (PDP) – evaluates requests and returns permit/deny decisions
- Relationship-based access – Google Zanzibar pattern for hierarchical, inherited permissions
- Kubernetes admission – validate, mutate, and generate K8s resources at admission time
- Formal verification – provable policy correctness (Cedar)
- Audit trail – decision logging for compliance and debugging
- Real-time sync – live policy and context data updates (OPAL)
Evaluation Criteria
- Policy language – expressiveness, readability, learning curve
- Authorization models – RBAC, ABAC, ReBAC, hybrid support
- Performance – decision latency (sub-ms to low-ms), throughput
- Scalability – millions of relationships or policy rules
- Deployment – sidecar, standalone service, embedded library, SaaS
- Ecosystem – SDKs, integrations, community
- Administration – UI for policy authoring, testing, distribution
- Audit – decision logging, compliance reporting
- Licensing – OSS vs proprietary; cost model
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Deployment Model
| Tool | License | Self-Hosted | SaaS | Docker |
|---|---|---|---|---|
| OPA | Apache-2.0 | Yes | No | Yes |
| Styra DAS | Proprietary | No | Yes | N/A |
| Gatekeeper | Apache-2.0 | Yes | No | Yes |
| Kyverno | Apache-2.0 | Yes | No | Yes |
| Cedar | Apache-2.0 | Yes | No | Yes |
| Casbin | Apache-2.0 | Yes | No | Yes |
| SpiceDB | Apache-2.0 | Yes | Yes | Yes |
| OpenFGA | Apache-2.0 | Yes | Yes | Yes |
| Cerbos | Apache-2.0 | Yes | Yes | Yes |
| Permit.io | Proprietary | Hybrid | Yes | Agent |
| OPAL | Apache-2.0 | Yes | No | Yes |
| Topaz | Apache-2.0 | Yes | Yes | Yes |
| Oso Cloud | Proprietary | No | Yes | N/A |
| Permify | Apache-2.0 | Yes | Yes | Yes |
| Ory Keto | Apache-2.0 | Yes | Yes | Yes |
| Paralus | Apache-2.0 | Yes | No | Yes |
Policy Language & Model
| Tool | Language | RBAC | ABAC | ReBAC | PBAC |
|---|---|---|---|---|---|
| OPA | Rego | Yes | Yes | No | Yes |
| Styra DAS | Rego | Yes | Yes | No | Yes |
| Gatekeeper | Rego+CRD | Yes | Yes | No | Yes |
| Kyverno | YAML | Yes | Yes | No | Yes |
| Cedar | Cedar | Yes | Yes | No | No |
| Casbin | PERM model | Yes | Yes | Yes | Yes |
| SpiceDB | ZanzibarDSL | Yes | No | Yes | No |
| OpenFGA | DSL/JSON | Yes | Yes | Yes | No |
| Cerbos | YAML | Yes | Yes | No | Yes |
| Permit.io | Rego/Cedar | Yes | Yes | Yes | Yes |
| OPAL | (admin layer) | – | – | – | – |
| Topaz | Rego | Yes | Yes | Yes | Yes |
| Oso Cloud | Polar | Yes | Yes | Yes | No |
| Permify | PermifyDSL | Yes | Yes | Yes | No |
| Ory Keto | Namespace | Yes | No | Yes | No |
| Paralus | K8s RBAC | Yes | No | No | No |
Best general-purpose: OPA (Rego, universal), Cedar (readable, formally verifiable). Best ReBAC: SpiceDB and OpenFGA (Zanzibar pattern, relationship graphs at scale). Best K8s: Kyverno (YAML-native, no Rego), Gatekeeper (OPA-based, CRD-driven).
Architecture & Performance
| Tool | Type | Stateless | Latency | Written In |
|---|---|---|---|---|
| OPA | PDP daemon | Yes | Sub-ms | Go |
| Styra DAS | Control plane | N/A | N/A | N/A |
| Gatekeeper | K8s webhook | Yes | Low-ms | Go |
| Kyverno | K8s webhook | Yes | Low-ms | Go |
| Cedar | Library/svc | Yes | Sub-ms | Rust |
| Casbin | Library | Yes | Sub-ms | Go/Multi |
| SpiceDB | Database | No | Low-ms | Go |
| OpenFGA | Service | No | Low-ms | Go |
| Cerbos | PDP sidecar | Yes | Sub-ms | Go |
| Permit.io | SaaS+agent | Hybrid | Low-ms | Python |
| OPAL | Admin layer | N/A | N/A | Python |
| Topaz | PDP+store | Hybrid | Low-ms | Go |
| Oso Cloud | SaaS | N/A | <10ms P90 | Rust |
| Permify | Service | No | Low-ms | Go |
| Ory Keto | Service | No | <10ms P95 | Go |
| Paralus | K8s overlay | N/A | N/A | Go |
Stateless PDPs (OPA, Cedar, Cerbos, Casbin): all policy data loaded in-memory; decisions require no database calls; ideal for sidecar deployment.
Stateful ReBAC (SpiceDB, OpenFGA, Permify, Ory Keto): store relationship tuples in a database; decisions require graph traversal; optimised for relationship-heavy workloads.
Kubernetes Integration
| Tool | K8s Admission | Validate | Mutate | Generate |
|---|---|---|---|---|
| OPA | Via Gatekeeper | Yes | No | No |
| Styra DAS | Via Gatekeeper | Yes | No | No |
| Gatekeeper | Native | Yes | Yes | No |
| Kyverno | Native | Yes | Yes | Yes |
| Cedar | No | No | No | No |
| Casbin | No | No | No | No |
| SpiceDB | No | No | No | No |
| OpenFGA | No | No | No | No |
| Cerbos | No | No | No | No |
| Permit.io | No | No | No | No |
| OPAL | No | No | No | No |
| Topaz | No | No | No | No |
| Oso Cloud | No | No | No | No |
| Permify | No | No | No | No |
| Ory Keto | No | No | No | No |
| Paralus | Overlay | Yes | No | No |
Kyverno advantage: only tool that generates K8s resources (e.g., auto-create NetworkPolicy when a namespace is created) and uses native YAML instead of Rego.
SDK & Language Support
| Tool | Go | Java | Python | Node | Rust | .NET |
|---|---|---|---|---|---|---|
| OPA | Yes | Yes | Yes | Yes | Yes | Yes |
| Styra DAS | OPA | OPA | OPA | OPA | OPA | OPA |
| Gatekeeper | N/A | N/A | N/A | N/A | N/A | N/A |
| Kyverno | N/A | N/A | N/A | N/A | N/A | N/A |
| Cedar | No | Yes | Yes | No | Yes | No |
| Casbin | Yes | Yes | Yes | Yes | Yes | Yes |
| SpiceDB | Yes | Yes | Yes | Yes | Yes | Yes |
| OpenFGA | Yes | Yes | Yes | Yes | No | Yes |
| Cerbos | Yes | Yes | Yes | Yes | Yes | Yes |
| Permit.io | No | Yes | Yes | Yes | No | Yes |
| OPAL | N/A | N/A | N/A | N/A | N/A | N/A |
| Topaz | Yes | No | Yes | Yes | No | Yes |
| Oso Cloud | Yes | Yes | Yes | Yes | Yes | Yes |
| Permify | Yes | Yes | Yes | Yes | No | No |
| Ory Keto | Yes | No | Yes | Yes | No | No |
| Paralus | N/A | N/A | N/A | N/A | N/A | N/A |
Best Go support: OPA (native Go), Casbin (Go origin), SpiceDB (Go origin), Cerbos (Go).
CNCF Status & Maturity
| Tool | CNCF Status | GitHub Stars | First Release |
|---|---|---|---|
| OPA | Graduated | 10,000+ | 2016 |
| Gatekeeper | – (OPA sub) | 3,700+ | 2019 |
| Kyverno | Incubating | 6,000+ | 2019 |
| OpenFGA | Incubating | 3,000+ | 2022 |
| SpiceDB | – | 6,000+ | 2021 |
| Cerbos | – | 3,500+ | 2021 |
| Casbin | – (Apache) | 18,000+ | 2017 |
| Cedar | – | 4,000+ | 2023 |
| Permify | – | 5,000+ | 2022 |
| Ory Keto | – | 5,000+ | 2018 |
| Topaz | – | 1,000+ | 2023 |
| OPAL | – | 4,500+ | 2021 |
| Paralus | Sandbox | 900+ | 2022 |
SSO / OIDC Detail
| Tool | SAML | OIDC | SCIM | Notes |
|---|---|---|---|---|
| OPA | No | No | No | Evaluates JWT claims |
| Styra DAS | Yes | Yes | Yes | Admin console SSO |
| Gatekeeper | No | No | No | K8s RBAC auth |
| Kyverno | No | No | No | K8s RBAC auth |
| Cedar | No | No | No | Library; no UI |
| Casbin | No | No | No | Library; no UI |
| SpiceDB | No | No | No | API-key auth |
| OpenFGA | No | No | No | API-key auth |
| Cerbos | No | No | No | No admin UI |
| Permit.io | Yes | Yes | No | Admin console SSO |
| OPAL | No | No | No | No admin UI |
| Topaz | No | Yes | No | Aserto console |
| Oso Cloud | Yes | Yes | No | Admin console SSO |
| Permify | No | No | No | API-key auth |
| Ory Keto | No | No | No | Part of Ory stack |
| Paralus | No | Yes | No | OIDC integration |
Policy engines are typically backend services called by applications; SSO applies to their admin consoles (SaaS offerings) rather than policy evaluation. OPA can validate JWT tokens and extract claims as part of policy evaluation.
Pricing
| Tool | Model | Free Tier | Starting |
|---|---|---|---|
| OPA | Self-hosted | Yes | Free |
| Styra DAS | SaaS | Free (5 sys) | Custom |
| Gatekeeper | Self-hosted | Yes | Free |
| Kyverno | Self-hosted | Yes | Free |
| Cedar | Self-hosted | Yes | Free |
| Casbin | Self-hosted | Yes | Free |
| SpiceDB | Self/SaaS | Yes | Free / custom |
| OpenFGA | Self/SaaS | Yes | Free |
| Cerbos | Self/SaaS | Yes | Free / custom |
| Permit.io | SaaS | Yes (1k MAU) | $150/mo |
| OPAL | Self-hosted | Yes | Free |
| Topaz | Self/SaaS | Yes | Free / custom |
| Oso Cloud | SaaS | Yes (dev) | Custom |
| Permify | Self/SaaS | Yes | Free / custom |
| Ory Keto | Self/SaaS | Yes | Free / custom |
| Paralus | Self-hosted | Yes | Free |
Best value: all 13 OSS tools are Apache-2.0 and free to self-host. Commercial offerings (Styra, Permit.io, Oso) add management UIs, hosted infrastructure, and support SLAs.
Recommendation Summary
| Segment | Recommended | Rationale |
|---|---|---|
| General policy | OPA | CNCF Graduated, Rego, universal |
| Readable policy | Cedar | Formally verifiable, AWS-backed |
| K8s admission | Kyverno | YAML-native, validate+mutate+generate |
| K8s + OPA | Gatekeeper | OPA-based CRDs for K8s |
| App authz (ReBAC) | SpiceDB | Zanzibar, Go, battle-tested |
| App authz (CNCF) | OpenFGA | CNCF Incubating, RBAC+ABAC+ReBAC |
| Stateless PDP | Cerbos | YAML policies, sidecar, Go |
| Embeddable lib | Casbin | 15+ languages, multi-model |
| OPA + ReBAC | Topaz | OPA engine + Zanzibar directory |
| Managed authz | Permit.io | No-code UI, OPA/Cedar backend |
| Policy sync | OPAL | Real-time OPA/Cedar data push |
| Enterprise OPA | Styra DAS | OPA creators, governance |
Tools
16 tools.
Casbin
Casbin is an authorization library that implements a PERM (Policy, Effect, Request, Matchers) metamodel, allowing developers to define any access control model through a configuration file rather than hardcoding it.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Cedar
Cedar is a policy language and evaluation engine created by AWS, designed for writing and enforcing authorization policies that are readable, analysable, and fast.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Cerbos
Cerbos is an open-source, stateless policy decision point for application authorization, evaluating YAML-defined RBAC and ABAC policies locally over gRPC and HTTP with sub-millisecond latency.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Kyverno
Kyverno is a CNCF Incubating Kubernetes-native policy engine that uses YAML-based policies instead of a specialized policy language like Rego.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, k8s · SSO: none
OPA Gatekeeper
OPA Gatekeeper is a Kubernetes admission controller that uses Open Policy Agent as its policy evaluation engine.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, k8s · SSO: none
OPAL (Open Policy Administration Layer)
OPAL (Open Policy Administration Layer) is an open-source real-time policy and data synchronization layer for OPA and Cedar policy engines, pushing policy and data updates to all decision points within seconds.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Open Policy Agent (OPA)
Open Policy Agent is a CNCF Graduated general-purpose policy engine that decouples policy decisions from application code. Policies are written in Rego, a purpose-built declarative query language that operates on any JSON input.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
OpenFGA
OpenFGA is a CNCF Incubating Zanzibar-inspired authorization system originally created by Auth0 (now Okta).
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Ory Keto
Ory Keto is a Google Zanzibar-inspired permission service and part of the broader Ory ecosystem, which includes Kratos (identity management), Hydra (OAuth2/OIDC provider), and Oathkeeper (API access proxy).
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Oso Cloud
Oso Cloud is an authorization-as-a-service platform built around Polar, a declarative policy language with Prolog-like semantics.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: OIDC, SAML
Paralus
Paralus is a zero-trust Kubernetes access management tool that provides centralized RBAC for multiple Kubernetes clusters.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, k8s · SSO: none
Permify
Permify is a Google Zanzibar-inspired authorization service that stores and evaluates relationship-based access control (ReBAC).
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Permit.io
Permit.io is an authorization-as-a-service platform that provides a no-code UI for defining and managing access control policies.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
SpiceDB
SpiceDB is an open-source implementation of Google Zanzibar, the global authorization system described in Google’s 2019 paper.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Styra DAS
Styra DAS (Declarative Authorization Service) is the commercial OPA management platform built by the creators of Open Policy Agent.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
Topaz
Topaz is an open-source authorizer by Aserto that combines OPA’s Rego policy engine with a built-in directory modeled after Google’s Zanzibar pattern.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
