Overview
Mix (16 tools)
- License: 13 open source · 3 proprietary
- Hosting: 13 self-hosted · 2 SaaS · 1 both
Policy engines decouple authorization decisions from application code. They evaluate requests against policies defined as code, relationships, or rules, returning permit/deny decisions that applications enforce. This category covers standalone policy platforms – not the policy features built into directory services (see Directory Services) or identity providers (see IAM & Identity Governance (IGA)).
Sub-Categories
The landscape divides into distinct groups:
- General policy engines – language-agnostic policy evaluation (OPA/Rego, Cedar)
- Kubernetes admission controllers – K8s- specific policy enforcement (Gatekeeper, Kyverno)
- Zanzibar-inspired ReBAC – relationship- based permissions at scale (SpiceDB, OpenFGA, Permify, Ory Keto)
- Application authorization PDPs – stateless or embedded decision points (Cerbos, Topaz, Casbin)
- Authorization-as-a-service – managed SaaS platforms (Permit.io, Oso, Styra DAS)
- Policy administration – real-time policy and data distribution (OPAL)
Key Capabilities
- Policy-as-code – policies defined in declarative languages (Rego, Cedar, YAML, Polar) versioned in Git
- Authorization models – RBAC, ABAC, ReBAC, PBAC, ACL, or hybrid models
- Policy Decision Point (PDP) – evaluates requests and returns permit/deny decisions
- Relationship-based access – Google Zanzibar pattern for hierarchical, inherited permissions
- Kubernetes admission – validate, mutate, and generate K8s resources at admission time
- Formal verification – provable policy correctness (Cedar)
- Audit trail – decision logging for compliance and debugging
- Real-time sync – live policy and context data updates (OPAL)
Evaluation Criteria
- Policy language – expressiveness, readability, learning curve
- Authorization models – RBAC, ABAC, ReBAC, hybrid support
- Performance – decision latency (sub-ms to low-ms), throughput
- Scalability – millions of relationships or policy rules
- Deployment – sidecar, standalone service, embedded library, SaaS
- Ecosystem – SDKs, integrations, community
- Administration – UI for policy authoring, testing, distribution
- Audit – decision logging, compliance reporting
- Licensing – OSS vs proprietary; cost model
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Deployment Model
| Tool | License | Self-Hosted | SaaS | Docker |
|---|---|---|---|---|
| OPA | Apache-2.0 | Yes | No | Yes |
| Styra DAS | Proprietary | No | Yes | N/A |
| Gatekeeper | Apache-2.0 | Yes | No | Yes |
| Kyverno | Apache-2.0 | Yes | No | Yes |
| Cedar | Apache-2.0 | Yes | No | Yes |
| Casbin | Apache-2.0 | Yes | No | Yes |
| SpiceDB | Apache-2.0 | Yes | Yes | Yes |
| OpenFGA | Apache-2.0 | Yes | Yes | Yes |
| Cerbos | Apache-2.0 | Yes | Yes | Yes |
| Permit.io | Proprietary | Hybrid | Yes | Agent |
| OPAL | Apache-2.0 | Yes | No | Yes |
| Topaz | Apache-2.0 | Yes | Yes | Yes |
| Oso Cloud | Proprietary | No | Yes | N/A |
| Permify | Apache-2.0 | Yes | Yes | Yes |
| Ory Keto | Apache-2.0 | Yes | Yes | Yes |
| Paralus | Apache-2.0 | Yes | No | Yes |
Policy Language & Model
| Tool | Language | RBAC | ABAC | ReBAC | PBAC |
|---|---|---|---|---|---|
| OPA | Rego | Yes | Yes | No | Yes |
| Styra DAS | Rego | Yes | Yes | No | Yes |
| Gatekeeper | Rego+CRD | Yes | Yes | No | Yes |
| Kyverno | YAML | Yes | Yes | No | Yes |
| Cedar | Cedar | Yes | Yes | No | No |
| Casbin | PERM model | Yes | Yes | Yes | Yes |
| SpiceDB | ZanzibarDSL | Yes | No | Yes | No |
| OpenFGA | DSL/JSON | Yes | Yes | Yes | No |
| Cerbos | YAML | Yes | Yes | No | Yes |
| Permit.io | Rego/Cedar | Yes | Yes | Yes | Yes |
| OPAL | (admin layer) | – | – | – | – |
| Topaz | Rego | Yes | Yes | Yes | Yes |
| Oso Cloud | Polar | Yes | Yes | Yes | No |
| Permify | PermifyDSL | Yes | Yes | Yes | No |
| Ory Keto | Namespace | Yes | No | Yes | No |
| Paralus | K8s RBAC | Yes | No | No | No |
Best general-purpose: OPA (Rego, universal), Cedar (readable, formally verifiable). Best ReBAC: SpiceDB and OpenFGA (Zanzibar pattern, relationship graphs at scale). Best K8s: Kyverno (YAML-native, no Rego), Gatekeeper (OPA-based, CRD-driven).
Architecture & Performance
| Tool | Type | Stateless | Latency | Written In |
|---|---|---|---|---|
| OPA | PDP daemon | Yes | Sub-ms | Go |
| Styra DAS | Control plane | N/A | N/A | N/A |
| Gatekeeper | K8s webhook | Yes | Low-ms | Go |
| Kyverno | K8s webhook | Yes | Low-ms | Go |
| Cedar | Library/svc | Yes | Sub-ms | Rust |
| Casbin | Library | Yes | Sub-ms | Go/Multi |
| SpiceDB | Database | No | Low-ms | Go |
| OpenFGA | Service | No | Low-ms | Go |
| Cerbos | PDP sidecar | Yes | Sub-ms | Go |
| Permit.io | SaaS+agent | Hybrid | Low-ms | Python |
| OPAL | Admin layer | N/A | N/A | Python |
| Topaz | PDP+store | Hybrid | Low-ms | Go |
| Oso Cloud | SaaS | N/A | <10ms P90 | Rust |
| Permify | Service | No | Low-ms | Go |
| Ory Keto | Service | No | <10ms P95 | Go |
| Paralus | K8s overlay | N/A | N/A | Go |
Stateless PDPs (OPA, Cedar, Cerbos, Casbin): all policy data loaded in-memory; decisions require no database calls; ideal for sidecar deployment.
Stateful ReBAC (SpiceDB, OpenFGA, Permify, Ory Keto): store relationship tuples in a database; decisions require graph traversal; optimised for relationship-heavy workloads.
Kubernetes Integration
| Tool | K8s Admission | Validate | Mutate | Generate |
|---|---|---|---|---|
| OPA | Via Gatekeeper | Yes | No | No |
| Styra DAS | Via Gatekeeper | Yes | No | No |
| Gatekeeper | Native | Yes | Yes | No |
| Kyverno | Native | Yes | Yes | Yes |
| Cedar | No | No | No | No |
| Casbin | No | No | No | No |
| SpiceDB | No | No | No | No |
| OpenFGA | No | No | No | No |
| Cerbos | No | No | No | No |
| Permit.io | No | No | No | No |
| OPAL | No | No | No | No |
| Topaz | No | No | No | No |
| Oso Cloud | No | No | No | No |
| Permify | No | No | No | No |
| Ory Keto | No | No | No | No |
| Paralus | Overlay | Yes | No | No |
Kyverno advantage: only tool that generates K8s resources (e.g., auto-create NetworkPolicy when a namespace is created) and uses native YAML instead of Rego.
SDK & Language Support
| Tool | Go | Java | Python | Node | Rust | .NET |
|---|---|---|---|---|---|---|
| OPA | Yes | Yes | Yes | Yes | Yes | Yes |
| Styra DAS | OPA | OPA | OPA | OPA | OPA | OPA |
| Gatekeeper | N/A | N/A | N/A | N/A | N/A | N/A |
| Kyverno | N/A | N/A | N/A | N/A | N/A | N/A |
| Cedar | No | Yes | Yes | No | Yes | No |
| Casbin | Yes | Yes | Yes | Yes | Yes | Yes |
| SpiceDB | Yes | Yes | Yes | Yes | Yes | Yes |
| OpenFGA | Yes | Yes | Yes | Yes | No | Yes |
| Cerbos | Yes | Yes | Yes | Yes | Yes | Yes |
| Permit.io | No | Yes | Yes | Yes | No | Yes |
| OPAL | N/A | N/A | N/A | N/A | N/A | N/A |
| Topaz | Yes | No | Yes | Yes | No | Yes |
| Oso Cloud | Yes | Yes | Yes | Yes | Yes | Yes |
| Permify | Yes | Yes | Yes | Yes | No | No |
| Ory Keto | Yes | No | Yes | Yes | No | No |
| Paralus | N/A | N/A | N/A | N/A | N/A | N/A |
Best Go support: OPA (native Go), Casbin (Go origin), SpiceDB (Go origin), Cerbos (Go).
CNCF Status & Maturity
| Tool | CNCF Status | GitHub Stars | First Release |
|---|---|---|---|
| OPA | Graduated | 10,000+ | 2016 |
| Gatekeeper | – (OPA sub) | 3,700+ | 2019 |
| Kyverno | Incubating | 6,000+ | 2019 |
| OpenFGA | Incubating | 3,000+ | 2022 |
| SpiceDB | – | 6,000+ | 2021 |
| Cerbos | – | 3,500+ | 2021 |
| Casbin | – (Apache) | 18,000+ | 2017 |
| Cedar | – | 4,000+ | 2023 |
| Permify | – | 5,000+ | 2022 |
| Ory Keto | – | 5,000+ | 2018 |
| Topaz | – | 1,000+ | 2023 |
| OPAL | – | 4,500+ | 2021 |
| Paralus | Sandbox | 900+ | 2022 |
SSO / OIDC Detail
| Tool | SAML | OIDC | SCIM | Notes |
|---|---|---|---|---|
| OPA | No | No | No | Evaluates JWT claims |
| Styra DAS | Yes | Yes | Yes | Admin console SSO |
| Gatekeeper | No | No | No | K8s RBAC auth |
| Kyverno | No | No | No | K8s RBAC auth |
| Cedar | No | No | No | Library; no UI |
| Casbin | No | No | No | Library; no UI |
| SpiceDB | No | No | No | API-key auth |
| OpenFGA | No | No | No | API-key auth |
| Cerbos | No | No | No | No admin UI |
| Permit.io | Yes | Yes | No | Admin console SSO |
| OPAL | No | No | No | No admin UI |
| Topaz | No | Yes | No | Aserto console |
| Oso Cloud | Yes | Yes | No | Admin console SSO |
| Permify | No | No | No | API-key auth |
| Ory Keto | No | No | No | Part of Ory stack |
| Paralus | No | Yes | No | OIDC integration |
Policy engines are typically backend services called by applications; SSO applies to their admin consoles (SaaS offerings) rather than policy evaluation. OPA can validate JWT tokens and extract claims as part of policy evaluation.
Pricing
| Tool | Model | Free Tier | Starting |
|---|---|---|---|
| OPA | Self-hosted | Yes | Free |
| Styra DAS | SaaS | Free (5 sys) | Custom |
| Gatekeeper | Self-hosted | Yes | Free |
| Kyverno | Self-hosted | Yes | Free |
| Cedar | Self-hosted | Yes | Free |
| Casbin | Self-hosted | Yes | Free |
| SpiceDB | Self/SaaS | Yes | Free / custom |
| OpenFGA | Self/SaaS | Yes | Free |
| Cerbos | Self/SaaS | Yes | Free / custom |
| Permit.io | SaaS | Yes (1k MAU) | $150/mo |
| OPAL | Self-hosted | Yes | Free |
| Topaz | Self/SaaS | Yes | Free / custom |
| Oso Cloud | SaaS | Yes (dev) | Custom |
| Permify | Self/SaaS | Yes | Free / custom |
| Ory Keto | Self/SaaS | Yes | Free / custom |
| Paralus | Self-hosted | Yes | Free |
Best value: all 13 OSS tools are Apache-2.0 and free to self-host. Commercial offerings (Styra, Permit.io, Oso) add management UIs, hosted infrastructure, and support SLAs.
Recommendation Summary
| Segment | Recommended | Rationale |
|---|---|---|
| General policy | OPA | CNCF Graduated, Rego, universal |
| Readable policy | Cedar | Formally verifiable, AWS-backed |
| K8s admission | Kyverno | YAML-native, validate+mutate+generate |
| K8s + OPA | Gatekeeper | OPA-based CRDs for K8s |
| App authz (ReBAC) | SpiceDB | Zanzibar, Go, battle-tested |
| App authz (CNCF) | OpenFGA | CNCF Incubating, RBAC+ABAC+ReBAC |
| Stateless PDP | Cerbos | YAML policies, sidecar, Go |
| Embeddable lib | Casbin | 15+ languages, multi-model |
| OPA + ReBAC | Topaz | OPA engine + Zanzibar directory |
| Managed authz | Permit.io | No-code UI, OPA/Cedar backend |
| Policy sync | OPAL | Real-time OPA/Cedar data push |
| Enterprise OPA | Styra DAS | OPA creators, governance |
Tools
16 tools.
Casbin
Casbin is an authorization library that implements a PERM (Policy, Effect, Request, Matchers) metamodel, allowing developers to define any access control model through a configuration file rather than hardcoding it.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Cedar
Cedar is a policy language and evaluation engine created by AWS, designed for writing and enforcing authorization policies that are readable, analysable, and fast.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Cerbos
Cerbos is an open-source, stateless policy decision point for application authorization, evaluating YAML-defined RBAC and ABAC policies locally over gRPC and HTTP with sub-millisecond latency.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Kyverno
Kyverno is a CNCF Incubating Kubernetes-native policy engine that uses YAML-based policies instead of a specialized policy language like Rego.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
OPA Gatekeeper
OPA Gatekeeper is a Kubernetes admission controller that uses Open Policy Agent as its policy evaluation engine.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
OPAL (Open Policy Administration Layer)
OPAL (Open Policy Administration Layer) is an open-source real-time policy and data synchronization layer for OPA and Cedar policy engines, pushing policy and data updates to all decision points within seconds.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Open Policy Agent (OPA)
Open Policy Agent is a CNCF Graduated general-purpose policy engine that decouples policy decisions from application code. Policies are written in Rego, a purpose-built declarative query language that operates on any JSON input.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
OpenFGA
OpenFGA is a CNCF Incubating Zanzibar-inspired authorization system originally created by Auth0 (now Okta).
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Ory Keto
Ory Keto is a Google Zanzibar-inspired permission service and part of the broader Ory ecosystem, which includes Kratos (identity management), Hydra (OAuth2/OIDC provider), and Oathkeeper (API access proxy).
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Oso Cloud
Oso Cloud is an authorization-as-a-service platform built around Polar, a declarative policy language with Prolog-like semantics.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
Paralus
Paralus is a zero-trust Kubernetes access management tool that provides centralized RBAC for multiple Kubernetes clusters.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, k8s · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Permify
Permify is a Google Zanzibar-inspired authorization service that stores and evaluates relationship-based access control (ReBAC).
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Permit.io
Permit.io is an authorization-as-a-service platform that provides a no-code UI for defining and managing access control policies.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
SpiceDB
SpiceDB is an open-source implementation of Google Zanzibar, the global authorization system described in Google’s 2019 paper.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Styra DAS
Styra DAS (Declarative Authorization Service) is the commercial OPA management platform built by the creators of Open Policy Agent.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Topaz
Topaz is an open-source authorizer by Aserto that combines OPA’s Rego policy engine with a built-in directory modeled after Google’s Zanzibar pattern.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
