SpiceDB

What it is

SpiceDB is an open source authorization database built around Google's Zanzibar paper — the same relationship-based access control (ReBAC) model that backs permissions for Google Drive, Docs, and Photos. Instead of scattering permission checks across application code (if user.role == 'admin'), you model authorization as a graph of relationships (users, objects, and the relations between them) and query it centrally via gRPC or HTTP. It handles fine-grained, relationship-based permissions — "can this user view this document because they're a member of the team that owns the folder" — at scale, with consistency guarantees so permission checks don't race ahead of writes.

Who builds it and why

SpiceDB is developed by AuthZed, a company founded specifically to commercialize a Zanzibar-style authorization system after its founders worked on similar problems elsewhere. The open source project is the core engine; AuthZed sells a managed cloud offering and enterprise support on top. This is a fairly common OSS-core/commercial-wrapper model — the incentive is to make SpiceDB good enough that people trust it in production, then monetize the operational burden (multi-region deployment, backups, dashboards) rather than gating features behind a license.

Production readiness signal

• 6,823 GitHub stars, 78 contributors — a moderate, not massive, community. This is infrastructure plumbing, not a developer tool with viral adoption dynamics, so raw star count undersells actual production usage.
• Active commit history (latest release v1.54.0), suggesting a healthy release cadence rather than a stalled project.
• Apache-2.0 license — permissive, no copyleft concerns for embedding in commercial products.
• Written in Go, which fits the operational profile of teams already running Kubernetes-adjacent infrastructure.
• CNCF maturity level: not publicly available — SpiceDB is not currently a CNCF project, so it doesn't carry that governance signal. Evaluate it on its own engineering merits and AuthZed's track record, not a foundation stamp.
• Founding date: not publicly available.

Who should use this

• Teams building B2B SaaS with complex, nested permission structures (organizations → teams → projects → documents) where role-based access control (RBAC) alone breaks down.
• Platforms that need consistent, low-latency "can this user do X" checks at high query volume — SpiceDB is designed for read-heavy authorization checks, not just storage.
• Engineering orgs willing to model their permission system explicitly as a schema (SpiceDB's DSL) rather than embedding authorization logic ad hoc in application code.
• Anyone who's read the Zanzibar paper and wants that model without building it from scratch.

Who should NOT use this

• Small applications with simple RBAC (a handful of roles, no resource-level nesting) — this is significant operational overhead for a problem user.role in ['admin', 'editor'] already solves.
• Teams without capacity to run and tune a new stateful service — SpiceDB requires a backing datastore (Postgres, CockroachDB, Spanner, etc.) and careful attention to consistency tuning (zookies/zedtokens); it's not a drop-in library.
• Organizations wanting a fully managed, zero-ops solution immediately — self-hosting requires real distributed systems competence; if you don't want that, budget for AuthZed's hosted product instead.
• Projects needing attribute-based access control (ABAC) as the primary model — SpiceDB supports some attribute checks but its core strength is relationship graphs, not arbitrary attribute rules.

Alternatives

• Ory Keto — another open source Zanzibar implementation, part of the broader Ory identity stack, good fit if you're already using Ory Hydra/Kratos.
• OpenFGA — CNCF-hosted (Auth0/Okta-originated) Zanzibar-inspired authorization engine, similar model with different query language and community.
• Oso — a more library-embedded, policy-as-code approach (Polar language) rather than a standalone relationship database; better fit if you want authorization logic in-process rather than as a separate service.

Pricing

SpiceDB itself is fully open source under Apache-2.0 — no licensing cost, no feature gating. AuthZed sells a managed cloud version and enterprise support separately; self-hosting the OSS version costs you only infrastructure and operational time.