Openfga

The API covers authorization model management (defining types and relationships), tuple writes (recording user-resource relationships), and check operations (evaluating whether a subject has a relation to an object). The list objects and list users APIs enable agents to query the full set of accessible objects for a user or all users with access to an object — supporting authorization-aware resource listing. The expand API allows agents to inspect how a permission was derived through the relationship graph.

Reliability for self-hosted OpenFGA depends on the backing database (Postgres, MySQL, or SQLite) and deployment configuration. The check API performance depends on relationship graph depth — complex nested relationships require more traversal steps and increase check latency. Teams with deep relationship hierarchies should benchmark performance against their expected graph complexity.

OpenFGA is an open-source fine-grained authorization system inspired by Google's Zanzibar paper, developed by Auth0/Okta. It implements relationship-based access control (ReBAC), where permissions are derived from object relationship graphs rather than flat role assignments. This model is particularly powerful for collaborative document and resource sharing — the same permission model used by Google Drive (document editors can view, owners can share, etc.) can be expressed in OpenFGA's authorization model. For agents managing complex, object-level sharing permissions, OpenFGA provides the relationship storage and evaluation infrastructure.

Authentication to the OpenFGA server is configured by the deployment — the server supports no-auth, API key, and OIDC token modes. Self-hosted deployments should configure appropriate authentication for the deployment environment. The Okta FGA managed service adds enterprise authentication and availability guarantees.

Documentation is comprehensive and covers the authorization model language, tuple management, and query APIs clearly. The modeling guide — explaining how to express common permission systems (editor/viewer/owner, team membership, resource hierarchy) in OpenFGA's authorization model — is particularly valuable for teams designing permission systems. Teams should invest time in the modeling guide before implementation, as the ReBAC model requires upfront design work.