Open-source alternatives to Openfga

dockertest is a Docker integration testing library and programmatic Go client used to boot and manage ephemeral containers. It functions as a containerized test orchestrator that provides isolated environments for integration tests by managing the lifecycle of dependent services. The library handles ephemeral environment orchestration by provisioning temporary containers and networks. It ensures environment consistency through service readiness checks and automated resource cleanup to prevent leaks after test execution completes. The project covers containerized service validation, including

Casbin is an authorization library that provides a model-based engine for enforcing access control across diverse application environments. It decouples authorization logic from application code by using a configuration-driven approach, allowing developers to define access rules and evaluation logic independently. The system supports a wide range of access control models, including role-based, attribute-based, and relationship-based patterns, which are evaluated at runtime to determine if a subject is permitted to perform an action on a resource. The project distinguishes itself through a hig

Kratos is a centralized identity and access management server designed to handle user registration, authentication, and profile management. It functions as an identity flow orchestrator, managing the state and security of authentication processes across web, mobile, and command-line interfaces. The system provides a standards-compliant authorization server that issues tokens and manages delegated access for third-party applications and internal services, supporting multi-factor authentication and custom identity schemas to secure user accounts. The project distinguishes itself through a headl

Hanko is an open-source identity provider and customer identity and access management system. It serves as a passkey authentication service and an OAuth and SAML SSO gateway, allowing applications to authenticate users and issue tokens via standard identity protocols. The project distinguishes itself through a strong focus on passwordless access using WebAuthn-based passkeys and email-based passcodes. It provides framework-agnostic authentication interfaces as customizable web components that can be embedded directly into web applications to handle login, registration, and profile management.

Linkerd is a Kubernetes service mesh that manages network traffic between microservices. It functions as a transparent networking proxy, layer 7 traffic manager, and mutual TLS security layer, providing observability and reliability for service-to-service communication without requiring changes to application code. The project distinguishes itself through a sidecar-proxy architecture that intercepts TCP and application-level traffic to provide automatic mutual TLS encryption and identity verification. It enables cross-cluster service networking to link multiple clusters and implements cloud-n

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

NestJS Access Control is a role-based and attribute-based authorization framework designed for the NestJS ecosystem. It provides a declarative system for securing application routes and resources, allowing developers to enforce granular access policies through metadata-driven decorators. The framework distinguishes itself by supporting hierarchical role inheritance, which enables the resolution of complex permission sets by traversing parent and child role relationships. It also facilitates dynamic authorization management, allowing security rules to be loaded asynchronously from external dat

Casbin is an authorization library designed to manage application access control and permissions through a configurable model-based engine. It serves as a centralized system for verifying whether a user has permission to perform specific actions on a resource. The engine supports multiple access control models, including Role-Based Access Control, Attribute-Based Access Control, and Access Control Lists. It allows for the definition of role hierarchies and the evaluation of user, resource, and environment attributes to make access decisions. The library decouples authorization logic from dat

FalkorDB is a high-performance graph database management system and vector graph database. It serves as a knowledge graph construction tool and a GraphRAG knowledge store, integrating structured property graphs with vector search to provide grounded context for large language models. The engine is designed as a multi-tenant graph engine, capable of hosting thousands of isolated datasets within a single instance. The system distinguishes itself by using linear algebra for query execution, treating relationship tensors as matrix multiplications to achieve low-latency multi-hop traversals. It ut

Boto3 is the AWS SDK for Python, providing a programmatic interface for managing and automating AWS cloud infrastructure and services. It serves as a cloud management API client and resource manager for provisioning, configuring, and scaling virtual servers, databases, and storage. The library enables the implementation of infrastructure-as-code through declarative templates and scripts, allowing for the deployment of identical resource stacks across multiple accounts and geographic regions. It also provides a framework for coordinating distributed workflows, serverless functions, and contain

Space Cloud is a self-hosted, cloud-native backend-as-a-service suite. It functions as a Kubernetes-based serverless platform that provides a GraphQL and REST API gateway, a database API generator, and an event-driven orchestrator. The platform transforms SQL and NoSQL database schemas into secure endpoints, eliminating the need for manual backend development. It distinguishes itself by allowing remote data joins, which combine records from internal databases and external HTTP microservices within a single query. The system covers a broad range of capabilities, including rule-based access co

Potpie is an LLM codebase analysis platform and multi-agent orchestration framework designed to act as an AI software engineer. It parses repositories into a structured code knowledge graph, enabling AI agents to perform multi-hop reasoning, dependency tracing, and grounded technical analysis across large codebases. The system distinguishes itself through a spec-driven development framework where agents generate detailed technical specifications and architecture plans before implementing multi-file code changes. It utilizes a durable execution engine to coordinate specialized AI personas for

django-guardian is a Django object permission library that enables the assignment of fine-grained access rights to individual database records. This system provides object-level access control, allowing users or groups to be granted permissions for specific model instances rather than applying a single global rule to an entire data model. The library includes a permission manager for the Django administrative interface, which provides a visual dashboard to assign and audit these instance-specific security rules. It also features an anonymous access controller to define and verify permissions

CanCanCan is an authorization library for Ruby on Rails that lets developers define user permissions in a single, centralized file using a readable domain-specific language. It enforces those permissions across controllers, views, and database queries, providing a unified approach to access control in Rails applications. The library works by evaluating a prioritized list of rules that combine actions, models, and conditions, supporting aliases, blocks, and conditional logic. It automatically authorizes controller actions through Rails' before_action lifecycle, raising exceptions on unauthoriz

Kaneo is an open-source project management platform built around a kanban board interface for organizing tasks into columns with drag-and-drop status management. It functions as a self-hosted task manager that supports multiple workspaces, organizations, and role-based access control, with all persistent data stored in a PostgreSQL relational database and exposed through a RESTful JSON API. The platform distinguishes itself through deep external integration capabilities, connecting project workflows to GitHub, Gitea, Slack, Discord, and Telegram with automated event-driven actions. A webhook

Solid is a protocol and ecosystem for decentralized web applications that separates application logic from data storage. It enables users to store and control their personal information in personal online data stores, known as Pods, ensuring that individuals own their data rather than the applications they use. The project provides a framework for decentralized identity and authentication using WebID and OpenID Connect, decoupling identity from central providers. It implements a resource-level permission system via Web Access Control, allowing users to grant or deny read, write, and append ac

react-native-permissions is a cross-platform permissions library that provides a unified interface for requesting and checking system permissions across iOS, Android, and Windows. It functions as a permission status manager and device capability auditor to determine if access to sensitive data or hardware is granted, denied, or blocked. The project includes a media access controller to handle limited access to photos and contacts through system-native pickers. It also features a system settings integrator that directs users to device settings pages to manually toggle application and notificat

Pothos is a code-first GraphQL schema builder and framework designed for type-safe development. It allows developers to construct schemas using typed definitions in TypeScript, eliminating the need for external code generation steps. The framework distinguishes itself through a dedicated data mapper that connects GraphQL types to relational databases and ORMs, such as Prisma, while optimizing query resolution. It provides a full implementation of the Relay specification, including global object identification and cursor-based pagination. The project covers several core capability areas, incl

SpringBlade is a development framework and platform designed for building multi-tenant SaaS applications. It provides a comprehensive scaffold for both Spring Cloud microservices and monolithic Spring Boot architectures, enabling the rapid construction of enterprise-grade software. The platform distinguishes itself through integrated LLM orchestration and industrial IoT management. It features an LLM orchestration platform that combines large language models with knowledge bases and visual AI agent workflows, alongside an IoT hub for device connectivity, state synchronization, and edge flow o

Kinto is a cloud state backend designed for storing and synchronizing JSON data across multiple devices. It provides a centralized service for managing schema-less JSON records organized into buckets and collections, ensuring a consistent state through a REST API. The system supports collaborative data sharing by granting read and write access to specific documents or collections via user groups and permissions. It enables document synchronization using change feed tracking and deletion markers to update clients with the latest state. Capabilities include fine-grained access control, JSON sc

Kanidm is a centralized identity management server designed to handle authentication, authorization, and directory services across distributed infrastructure. It provides a comprehensive framework for managing human and service accounts, utilizing a schema-driven database to store identity records, group memberships, and system attributes. The platform supports a wide range of authentication methods, including passkeys, passwords, and standard protocols like OAuth2, OIDC, LDAP, and RADIUS. The system distinguishes itself through a granular access control engine that enforces security policies

Idurar is an integrated system combining Customer Relationship Management and Enterprise Resource Planning. It functions as a headless business API that generates secure REST endpoints and administrative panels from configuration files to connect business logic with external applications. The platform supports multi-tenant SaaS management, isolating data and configurations for multiple companies or branches within a single installation. It is designed for international business accounting, featuring a multi-currency financial engine that processes transactions and manages regional tax rules a

This project is a starter kit for building software as a service applications. It provides a foundational framework for developing scalable products with integrated subscription billing, user management, and automated cloud deployment pipelines. The core architecture centers on a multi-tenant application framework that isolates data and permissions between organizations using team workspaces and role-based access control. It utilizes a GraphQL API to ensure type-safe communication and data consistency between the frontend and backend. The system covers comprehensive identity and access manag

Astron-agent is an orchestration platform for designing and executing complex agentic workflows that combine language models with external tools and business systems. It provides a production-ready environment for deploying AI services within private intranets using container orchestration for scalable management. The platform distinguishes itself by linking large language model decision-making with robotic process automation to execute tasks across enterprise applications. It further supports enterprise requirements through a multi-tenant infrastructure that utilizes isolated memory and iden

vibe-vibe is an LLM agent engineering framework and toolchain optimizer designed for orchestrating multi-agent systems. It serves as a comprehensive guide and methodology for transforming conceptual ideas into deployed applications through agentic software engineering. The project focuses on the orchestration of specialized AI agent roles with defined collaboration boundaries and iterative feedback loops. It provides frameworks for toolchain optimization, including the selection and evaluation of protocols that extend model capabilities and the design of standardized tool interfaces. The sys

Ockam is a zero-trust networking framework designed to secure data transit between distributed applications using an identity-based network overlay. It provides the primitives necessary to establish mutually authenticated and end-to-end encrypted connections, removing the reliance on traditional network-layer security. The project is distinguished by its use of attribute-based access control and verifiable credentials to manage trust at scale. It implements cryptographic identity rotation to maintain identity continuity and integrates with hardware-backed key management systems to secure priv