OpenFGA — Fine-Grained Authorization at Scale

What it is

OpenFGA is an open-source fine-grained authorization system backed by the CNCF. It is inspired by Google's Zanzibar paper and uses a relationship-based access control (ReBAC) model. You define authorization policies as relationships between users and objects using a simple DSL, and OpenFGA evaluates access checks in milliseconds.

OpenFGA targets backend developers and platform engineers who need authorization beyond simple RBAC. If your application has complex permission hierarchies -- document sharing, team-based access, organizational policies -- OpenFGA models these as relationship tuples.

How it saves time or tokens

Implementing fine-grained authorization from scratch requires building a policy engine, a tuple store, and evaluation logic. OpenFGA provides all three out of the box. The authorization model DSL lets you express complex policies in a few lines, and the API handles evaluation, caching, and consistency.

For AI applications, OpenFGA can control which users or agents can access specific resources, datasets, or model endpoints. This is particularly useful for multi-tenant AI platforms.

How to use

1. Start OpenFGA with Docker:

docker pull openfga/openfga
docker run -p 8080:8080 -p 3000:3000 openfga/openfga run

1. Create a store and define an authorization model:

curl -X POST http://localhost:8080/stores \
  -H 'Content-Type: application/json' \
  -d '{"name": "my-app"}'

1. Write relationship tuples and check access via the REST API.

Example

# Authorization model DSL
model
  schema 1.1

type user

type document
  relations
    define owner: [user]
    define editor: [user] or owner
    define viewer: [user] or editor

# Write a relationship tuple
curl -X POST http://localhost:8080/stores/{store_id}/write \
  -H 'Content-Type: application/json' \
  -d '{
    "writes": {
      "tuple_keys": [
        {"user": "user:alice", "relation": "owner", "object": "document:report"}
      ]
    }
  }'

# Check access
curl -X POST http://localhost:8080/stores/{store_id}/check \
  -H 'Content-Type: application/json' \
  -d '{"tuple_key": {"user": "user:alice", "relation": "viewer", "object": "document:report"}}'
# Returns: {"allowed": true}

Related on TokRepo

• Security tools -- Browse other authorization and security tools
• API tools -- Explore API security and gateway solutions

Common pitfalls

• Authorization models must be written in OpenFGA's DSL, not arbitrary JSON. Syntax errors in the model definition produce cryptic error messages. Use the OpenFGA Playground to validate models before deploying.
• Relationship tuples accumulate over time. Without cleanup of stale tuples (e.g., when users leave an organization), the tuple store grows and check latency increases.
• OpenFGA evaluates authorization at request time. For pages showing many resources, batch the check calls using the list-objects API instead of making individual check calls per resource.