SpiceDB is an open source, Google Zanzibar-inspired database written in Go that stores and queries fine-grained authorization data, and it is built for platform and product teams that need a reliable answer to whether subject X can perform action Y on resource Z.

What it is

SpiceDB is an Apache-2.0 licensed project in the Infrastructure and Operations / Databases category, and it exists purely to handle authorization. Similar to a relational database, developers define a schema, write data in the form of relationships, and then use SpiceDB's clients to issue permission checks inside their applications to determine which actions a user can take on a resource. The design traces back to Google's 2019 paper, "Zanzibar: Google's Consistent, Global Authorization System", and the project describes itself as the most mature open source implementation inspired by that system. Development aims to remain faithful to the paper's values and goals while the implementation has moved beyond the functionality the paper outlines.

The concrete problem it addresses is broken access control, which OWASP ranked as the number one threat to web security as of 2021. Rather than letting every application and microservice carry its own access control lists and permission logic, SpiceDB is typically run as a centralized service shared across product suites and microservice architectures. This makes the authorization question answerable in one place instead of being reimplemented in each service. The project is deliberately scoped to authorization alone and is designed to be fully agnostic to authentication solutions and identity providers, so it complements rather than replaces an identity provider.

Key capabilities

• Fine-grained permission checks through a defined schema and a graph of relationships, queried by clients from application code.
• Reverse index queries that answer "What can subject do?" and "Who can access resource?" rather than only a single permission check.
• Caveated relationships that combine attribute-based access control (ABAC) with relationship-based access control (ReBAC) in one model.
• Per-request consistency configuration, which lets correctness and performance be decided case by case.
• Schema tooling with real-time validation, plus validation that can run inside a CI/CD workflow.
• Documented performance of 5ms p95 latency at millions of queries per second against billions of relationships.
• Binary releases for Linux, macOS, and Windows on AMD64 and ARM64 architectures.

Who uses it and how

• IBM's AI Data & Model Factory Platform is listed among community members using it in a platform context.
• Red Hat's Insights Platform appears on the same community list.
• GitPod is listed as a community member.
• TubiTV China and DMM Online Salon, published in Japanese, show adoption across regions and languages.
• Teams commonly run it as one centralized authorization service shared by multiple product suites and microservices, in cloud-native and Kubernetes environments.

Getting started

Install the binary: releases cover Linux, macOS, and Windows on AMD64 and ARM64, and Homebrew users on macOS and Linux can install the latest binary release of SpiceDB. Documentation is at https://authzed.com/docs.

How it compares

The facts supplied here name no competing tools or paid products that SpiceDB replaces, so it stands alone in this registry on a comparison basis. The only contrast the project itself draws is against Google's internal Zanzibar, which is not a system that can be adopted or self-hosted. SpiceDB therefore occupies the niche of a self-hosted, Zanzibar-inspired authorization database with no named alternative in the provided material.

When to use it — and when not to

Choose SpiceDB when authorization logic is already fragmented across services and needs a central, queryable source of truth that scales with traffic, geography, and functionality. A self-hoster must operate a centralized authorization service alongside the rest of the stack, and must already have an authentication solution, because SpiceDB deliberately does not provide one. The entry also shows 157 open issues, and the supplied facts do not detail the storage backends or operational dependencies, so those should be confirmed in the project documentation before committing.

brew install authzed/tap/spicedb authzed/tap/zed

sudo apt update && sudo apt install -y curl ca-certificates gpg
curl https://pkg.authzed.com/apt/gpg.key | sudo apt-key add -
sudo echo "deb https://pkg.authzed.com/apt/ * *" > /etc/apt/sources.list.d/fury.list
sudo apt update && sudo apt install -y spicedb zed

sudo cat << EOF >> /etc/yum.repos.d/Authzed-Fury.repo
[authzed-fury]
name=AuthZed Fury Repository
baseurl=https://pkg.authzed.com/yum/
enabled=1
gpgcheck=0
EOF
sudo dnf install -y spicedb zed

# expose grpc and http. http is used in the examples below.
docker run --rm -p 50051:50051 -p 8443:8443 authzed/spicedb serve --http-enabled true --grpc-preshared-key "somerandomkeyhere"