Open-source alternatives to Permify

Cerbos is an open-source authorization service that provides a centralized, language-agnostic engine for managing access control. It functions as a policy-as-code platform, allowing teams to define, test, and distribute authorization rules using declarative YAML or JSON configurations. By decoupling access logic from application code, it enables consistent permission enforcement across diverse service stacks. The project distinguishes itself through its ability to translate high-level authorization policies into native database query filters. This capability allows applications to enforce sec

Casbin is an authorization library that provides a model-based engine for enforcing access control across diverse application environments. It decouples authorization logic from application code by using a configuration-driven approach, allowing developers to define access rules and evaluation logic independently. The system supports a wide range of access control models, including role-based, attribute-based, and relationship-based patterns, which are evaluated at runtime to determine if a subject is permitted to perform an action on a resource. The project distinguishes itself through a hig

deepstream.io is an open-source realtime server that synchronizes JSON records, events, and remote procedure calls across clients and backend services. It functions as a realtime data sync server, event pub/sub server, record database server, and RPC server, all within a single platform. The server authenticates and authorizes every message using multiple strategies including JWT, HTTP, and file-based credentials, with a declarative permission language controlling access to records, events, and RPCs at a granular level. The platform distinguishes itself through its combination of realtime dat

Vendure is a Node.js e-commerce engine and headless commerce framework built with NestJS and TypeScript. It serves as a multi-channel commerce platform that manages product catalogs, orders, and customers via a strongly typed GraphQL API. The platform is distinguished by its highly extensible architecture, featuring a customizable administrative dashboard where developers can inject custom React components and entity views. It supports multi-channel commerce, allowing the isolation of products, currencies, and regional catalogs from a single unified backend. The engine covers a broad range o

TastyIgniter is a comprehensive restaurant management system and digital ordering engine. Built as a modular application framework, it provides the tools necessary to operate online food ordering, table reservation systems, and multi-vendor e-commerce platforms. The platform is designed to handle complex restaurant operations, including multi-location networking and multi-vendor marketplace management. It distinguishes itself through specialized restaurant automation, such as coordinating guest limits and time slots for bookings, managing ingredient and allergen catalogs, and implementing mul

Gitolite is a server-side management layer for self-hosted Git repositories that orchestrates repository settings and user access via SSH public keys. It functions as a Git configuration orchestrator, applying repository rules and user roles on a central Linux server to manage the lifecycle of hosted version control data. The system is distinguished by its Git-based administration model, where all users and access rules are stored in a dedicated Git repository that serves as the single source of truth. This allows server administrators to manage the hosting environment by pushing configuratio

Stellar Core is the primary software implementation of the Stellar blockchain network, serving as a distributed ledger and a Federated Byzantine Agreement system. It functions as a core node that maintains the shared state of the network and provides a runtime environment for executing WebAssembly smart contracts. The project enables the creation and management of digital assets, including the implementation of decentralized exchanges through distributed orderbooks and automated liquidity pools. It facilitates cross-border payment settlement by routing assets via path payments and bridging di

django-guardian is a Django object permission library that enables the assignment of fine-grained access rights to individual database records. This system provides object-level access control, allowing users or groups to be granted permissions for specific model instances rather than applying a single global rule to an entire data model. The library includes a permission manager for the Django administrative interface, which provides a visual dashboard to assign and audit these instance-specific security rules. It also features an anonymous access controller to define and verify permissions

Unkey is an API key management platform and gateway control plane designed for issuing, verifying, and revoking secure keys with global distribution. It provides the infrastructure necessary to authenticate requests and authorize access to protected resources with low latency. The platform distinguishes itself through edge-based request authentication and distributed rate limiting, which allow for the verification of keys and enforcement of request quotas at the network edge. It also features a usage-based billing engine and a self-service developer portal, enabling the tracking of metered AP

Hanko is an open-source identity provider and customer identity and access management system. It serves as a passkey authentication service and an OAuth and SAML SSO gateway, allowing applications to authenticate users and issue tokens via standard identity protocols. The project distinguishes itself through a strong focus on passwordless access using WebAuthn-based passkeys and email-based passcodes. It provides framework-agnostic authentication interfaces as customizable web components that can be embedded directly into web applications to handle login, registration, and profile management.

This project is a unified, cloud-native policy engine designed to decouple authorization and security logic from application codebases. It functions as a centralized authorization service that evaluates structured input data against declarative rules, enabling consistent policy enforcement across microservices, infrastructure, and continuous integration pipelines. The engine utilizes a specialized logic programming language to express complex constraints, which are compiled into an optimized intermediate representation for high-performance evaluation. By supporting both sidecar-based deployme

CASL is a JavaScript authorization library for defining and enforcing declarative access control rules across both frontend and backend environments. It provides an attribute-based access control system that manages permissions based on user roles and specific object properties. The library is designed for isomorphic access control, allowing a consistent set of permission rules to be shared between a server API and a client interface. It enables the serialization of permission sets as plain data objects to maintain synchronization across these different layers. Its capabilities include trans

Passwordless is a Node.js authentication library that enables secure user identity verification using one-time tokens instead of traditional passwords. It functions as a middleware-based identity provider, protecting application routes and resources by validating these tokens before granting access. The library distinguishes itself through a highly decoupled architecture that separates token generation, verification, and delivery. Developers can implement custom token delivery strategies to dispatch authentication codes via email, SMS, or voice services. Furthermore, the system supports both

This project is a self-hosted community engine and forum software designed for hosting threaded discussions. It functions as a JSON API community platform, exposing all data and functionality through a standardized interface to support a single-page application architecture. The system is built to be a multi-language discussion board with integrated localization and language pack support. The platform is defined by a modular architecture that allows for extensive customization through an extension-based plugin system. This extensibility enables the modification of core behavior, the addition

Fonoster is a conversational AI framework and multi-tenant communications platform as a service. It serves as a programmable voice gateway and SIP telephony platform, enabling the creation of voice-based assistants and automated communication workflows using large language models. The project distinguishes itself through a vendor-agnostic speech integration engine that abstracts speech-to-text and text-to-speech providers. It features a multi-tenant architecture that isolates telephony resources and user identities into distinct organizational workspaces. The system covers a broad range of t

This project is an agile project management platform designed to centralize task tracking, workflow organization, and team productivity monitoring. It provides a unified workspace where users can manage projects, tickets, and milestones through visual boards, while simultaneously recording time spent on specific activities to generate detailed performance reports. The platform distinguishes itself through its ability to consolidate data from multiple third-party management tools into a single, normalized schema. It incorporates a locale-aware interface framework that supports global teams by

Apostrophe is an open-source Node.js headless content management system that delivers structured content through REST APIs while providing a visual in-context page editor for live editing. It is built on a module-based plugin architecture that extends CMS functionality through reusable modules, each encapsulating logic, configuration, and templates. The system uses schema-driven content modeling to define data structures and validation rules through configurable schemas and custom field types, with all content stored as flexible JSON-like documents in MongoDB. The platform distinguishes itsel

EspoCRM is an open-source customer relationship management platform and SQL-based business application. It serves as a centralized web interface for tracking leads, opportunities, and contacts, providing a sales pipeline manager and a customizable business logic engine. The platform is distinguished by its ability to function as a custom business application builder, allowing for the creation of tailored entities and automated workflows. It integrates marketing automation tools for campaign coordination and a structured customer support ticketing system for case management. The system covers

go-admin is a full-stack admin scaffolding system that generates a complete backend management interface with built-in user, role, menu, and department management modules. It combines role-based access control enforcement, JWT token authentication, multi-tenant database isolation, and scheduled task scheduling into a single framework, with a Vue-based frontend rendered through reusable components. The project distinguishes itself by integrating a Casbin RBAC engine for granular permission management across menus, buttons, and API endpoints, alongside automatic API documentation generation fro

node-elm is a Node.js and MongoDB backend framework designed for building data-driven applications, specifically e-commerce systems and food delivery management platforms. It provides a foundation for managing product catalogs, shopping carts, and payment workflows. The system includes a dedicated administrative management dashboard for tracking system statistics and managing users and merchants through role-based access control. It also features a digital coupon management system for tracking and exchanging promotional rewards. The framework incorporates geolocation services for IP-based po

CanCanCan is an authorization library for Ruby on Rails that lets developers define user permissions in a single, centralized file using a readable domain-specific language. It enforces those permissions across controllers, views, and database queries, providing a unified approach to access control in Rails applications. The library works by evaluating a prioritized list of rules that combine actions, models, and conditions, supporting aliases, blocks, and conditional logic. It automatically authorizes controller actions through Rails' before_action lifecycle, raising exceptions on unauthoriz

EasyAdminBundle is a tool for automatically generating backend management interfaces for Symfony applications. It builds administrative screens and forms by mapping database entity definitions to user interface components, providing a web-based system for managing database records through searchable lists and CRUD forms. The project supports the creation of separate administration backends tailored for different user roles or external collaborators. It includes a security layer for restricting dashboards, menus, and data fields based on role-based access control and user security tokens. The

This is a Vue.js admin dashboard built with Element UI that provides a backend management interface for overseeing stores, products, users, and system settings. The project combines Vue's reactive component model with Element-UI's pre-built widget library to construct a consistent admin interface, using Vue Router for client-side navigation and Vuex for centralized state management. The admin panel enforces role-based access control, checking user permissions at route entry points and component boundaries to block unauthorized actions before they execute. It includes authentication and sessio

Apache Hive is a SQL-on-Hadoop data warehouse that enables querying and managing petabytes of data stored in distributed storage such as HDFS and cloud storage services. It provides a familiar SQL interface for batch analytics and reporting, supported by a core set of components including the HiveServer2 Thrift service for remote query execution, the Hive Metastore Service for central metadata management, the Hive ACID Transaction Engine for concurrent read-write operations, and the Hive LLAP Interactive Engine for low-latency analytical processing. The WebHCat REST API offers an HTTP interfac

Gauzy is an open business management platform and multi-tenant enterprise resource planning system. It provides a modular business framework designed to manage core organizational operations through a unified web interface or as a headless business API. The platform is distinguished by its integration with the Model Context Protocol, allowing it to act as a server that exposes business data and system functions as tools for AI assistants. It utilizes a dynamic plugin architecture and a dedicated marketplace to extend core business entities and services. The system covers a broad range of ope

This project is a self-hosted forum software and extensible community platform designed to facilitate online discussions and member engagement. It functions as a REST API discussion engine, providing a backend that manages community interactions and forum data via a standardized JSON interface for external applications. The platform is distinguished by a modular architecture that allows for deep customization through a package-based extension system and an interface extension framework. It employs an extender-based customization model, enabling external modules to modify internal system behav

Lamp Cloud is a multi-tenant SaaS backend framework built on Java and Spring Cloud that provides a complete foundation for building enterprise-grade administration systems. Its core identity centers on supporting multiple tenant isolation strategies—including database-per-tenant, schema-per-tenant, and shared-table modes—that can be switched without altering business code, alongside a role-based access control system enforced at the gateway layer across all microservices. The framework distinguishes itself through comprehensive tenant lifecycle management tools that allow creating, configurin