Ory Keto — Zanzibar-Based Permission Server for Fine-Grained Access

Introduction

Ory Keto is an open-source authorization server that implements Google's Zanzibar paper. It stores relationship tuples (who has what relation to which object) and evaluates permission checks by traversing those tuples, supporting deeply nested and inherited relationships at scale.

What Ory Keto Does

• Stores subject-object relationship tuples in a persistent backend
• Evaluates permission checks by traversing relationship graphs
• Expands relationship trees to show why a permission is granted or denied
• Exposes both gRPC and REST APIs for integration
• Supports namespaces to isolate different permission domains

Architecture Overview

Keto exposes a read API (port 4466) and a write API (port 4467) that operate on a relation tuple store. Permission checks traverse a directed graph of relationships defined by namespace configurations, which specify object types, relations, and how permissions inherit through userset rewrites. The backend uses SQL (PostgreSQL, MySQL, or SQLite) for tuple storage.

Self-Hosting & Configuration

• Deploy with Docker, Helm charts, or pre-built binaries for Linux, macOS, and Windows
• Configure via a YAML file specifying DSN, namespace definitions, and API settings
• Supports PostgreSQL, MySQL, CockroachDB, and SQLite as storage backends
• Namespace configurations define object types, relations, and permission inheritance rules
• Migrations are handled via the built-in keto migrate command

Key Features

• Full Zanzibar model with userset rewrites and intersection/exclusion operators
• Relationship expansion API for debugging and auditing permission paths
• gRPC-first design with auto-generated REST endpoints
• Multi-tenant namespace isolation for organizing permission domains
• Integrates with Ory Hydra and Ory Kratos for complete identity and access management

Comparison with Similar Tools

• Open Policy Agent (OPA) — Policy-as-code engine using Rego; Keto is relationship-based, not policy-rule-based
• Casbin — Library-level RBAC/ABAC; Keto is a standalone server with the Zanzibar graph model
• SpiceDB — Also Zanzibar-inspired; SpiceDB uses its own schema language while Keto aligns with the Ory ecosystem
• Keycloak — Identity provider with coarse RBAC; Keto provides fine-grained relationship-based authorization

FAQ

Q: How does Keto differ from traditional RBAC? A: Keto uses relationship tuples instead of static role assignments. Permissions are derived by traversing a graph, allowing fine-grained, context-dependent access decisions.

Q: Can Keto handle hierarchical permissions? A: Yes. Namespace configurations support userset rewrites, so a folder's viewer permission can automatically propagate to all documents inside it.

Q: Does Keto require other Ory components? A: No. Keto works standalone. It integrates well with Ory Hydra and Kratos but has no hard dependency on them.

Sources

• https://github.com/ory/keto
• https://www.ory.sh/docs/keto