Permit.io's company blog on authorization as a service, covering Google Zanzibar, OPA, Opal, and access control for AI.
HN commenters cite it for comparisons of Zanzibar-style and OPA authorization, and as a lighter starting point linked to a deeper article.
Data filtering implementation has different approaches among the mentioned policy engine. For OPA, custom Rego code could return the allowed data, and the caching mechanism will ensure its consistency and reliability. For Zanzibar, since the policy derived from the data relations, data filtering is using is an internal part of the paper.
I recommend the following article for more information about policy as code and policy as data to understand the context better - https://www.permit.io/blog/zanzibar-vs-opa
Here are some other AuthZ as a service providers I've heard of:
* Permit.io: https://www.permit.io/
* Oso: https://www.osohq.com/
And Otterize has an interesting model if you are in the k8s ecosystem: https://otterize.com/
I don't have first hand experience with any of these folks, though I have chatted with some of them.
In Zanziabr - The article refers to OSS implementations like SpiceDB or Ory.
It's a follow-up to a more in depth article (1), trying to be a lighter read starting point.
- 1: https://www.permit.io/blog/zanzibar-vs-opa
too quick man, it's a key feature:
https://www.permit.io/rebac