Awesome Open

Project record

OpenFGA

OpenFGAAuthorization and permissions engine inspired by Google Zanzibar.Apache-2.0
Field notes / 230OpenFGA
I / Function

Authorization and permissions engine inspired by Google Zanzibar.

OpenFGA is an authorization service for expressing and evaluating fine-grained application permissions. Developers define access models and query them through HTTP or gRPC APIs, using language SDKs or a command-line client. It can run as a standalone service or embedded Go library, with persistent database options and an in-memory backend for local evaluation.

OpenFGA official documentation · Reviewed 2026-10-27

A violet-gray stone gate aligns white channels edged in red around an open hinged passage.
Awesome Open* · Field recordOpenFGAOP-76697C39 · Folio 230Domain: Infrastructure & DevOps
  1. 01 / Feature noteAuthorization APIs

    Query modeled permissions through HTTP or gRPC interfaces.

    Feature source ↗
  2. 02 / Feature noteModel playground

    Model, visualize and test authorization setups in the local-development playground.

    Feature source ↗
II / Repository record

GitHub stars

6,085

Detected license

Apache-2.0

Repository created

2022-06-08

Repository push

2026-11-03

III / Observations & evidence

GitHub stars

Unknown

i
Window mismatch; awaiting refresh

Cached history uses a different month window; chart withheld until aligned.

Latest attempt: ok · Checked 2026-10-15T23:34:55.975088+00:00 · Last successful fetch 2026-10-15T23:34:55.975088+00:00 · Provider source

Hacker News stories

Unknown

i
Not recorded

OpenSSF Scorecard

9.3/10

Scanned 2026-11-02 · 18 scored / 18 returned

i
Available
  • Code-Review · 7/10

    Found 21/27 approved changesets -- score normalized to 7

  • Dependency-Update-Tool · 10/10

    update tool detected

  • Binary-Artifacts · 10/10

    no binaries found in the repo

  • Dangerous-Workflow · 10/10

    no dangerous workflow patterns detected

  • Maintained · 10/10

    30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10

  • Token-Permissions · 10/10

    GitHub workflow tokens follow principle of least privilege

  • Pinned-Dependencies · 9/10

    dependency not pinned by hash detected -- score normalized to 9

  • CII-Best-Practices · 5/10

    badge detected: Passing

  • Vulnerabilities · 8/10

    2 existing vulnerabilities detected

  • Fuzzing · 10/10

    project is fuzzed

  • Signed-Releases · 10/10

    5 out of the last 5 releases have a total of 10 signed artifacts.

  • Packaging · 10/10

    packaging workflow detected

  • SAST · 10/10

    SAST tool detected

  • License · 10/10

    license file detected

  • Branch-Protection · 8/10

    branch protection is not maximal on development and all release branches

  • Security-Policy · 10/10

    security policy file detected

  • CI-Tests · 10/10

    24 out of 24 merged PRs checked by a CI test -- score normalized to 10

  • Contributors · 10/10

    project has 28 contributing companies or organizations

Repository commit 2dfa5d30155b · Scorecard v5.5.0

Checked 2026-11-03T07:55:50Z · Last successful fetch 2026-11-03T07:55:50Z · Value fetched 2026-11-03T07:55:50Z · Provider source

IV / Release record

GitHub release

v1.22.1

Published 2026-10-28

i
Available

Checked 2026-11-04T04:04:05Z · Last successful fetch 2026-11-04T04:04:05Z · Value fetched 2026-11-04T04:04:05Z · Provider source

V / Where it runs

Unknown

i
Not reviewed