OpenFGA
An open-source authorization engine implementing the Zanzibar model — a readable DSL for defining types and relations, JSON tuples for facts, and a Check API for answering access questions.
OpenFGA is “Zanzibar for the rest of us” — the same relationship-tuple model and graph-traversal Check, but packaged as a self-hostable or managed service instead of Google-internal infrastructure. Beyond checking one relationship, it also answers the reverse question — listing every object a user can access — which a pure per-item Check loop can’t do efficiently.