Engineering teams burn months building and maintaining permission logic scattered across services. AuthZed gives you one schema, one API call, and a battle-tested engine — so you can stop maintaining authorization and get back to shipping.
Built on SpiceDB — the open-source, Google Zanzibar–inspired authorization database.
Replace bespoke per-service permission code with one engine and one schema.
Relationships express RBAC, ABAC, ReBAC, hierarchies, groups, and sharing — no rewrites.
Sub-25ms p95, strongly consistent decisions on the Google Zanzibar architecture.
Authorization becomes a schema: reviewed in PRs, validated in CI, no tribal knowledge.
gRPC/HTTP clients, the zed CLI, the Playground, and a Kubernetes Operator.
LookupResources answers “what can this user see?” in one call — no N+1.
Filtering a list by permission the naive way means a CheckPermission for every row. LookupResources returns only the IDs a user can access in a single request — the difference between a feature that scales and one that times out.
| Challenge | With AuthZed |
|---|---|
| Authorization code sprawl | One schema, one CheckPermission API |
| “What can this user list?” N+1 queries | LookupResources in a single call |
| Permission bugs shipped to prod | Versioned, tested policy in CI |
| Scaling the authz layer | Sub-25ms at billions of relationships |
| Every feature needs new authz plumbing | Model it once in the schema |
| Onboarding engineers to authz logic | A readable schema, not tribal knowledge |
Hard tenant boundaries by default, with explicit cross-tenant sharing when you need it.
Migrate off the permissions table no one wants to touch.
Org → team → project inheritance without exploding role logic.
Pre-filter results with LookupResources instead of post-filtering.
Ship document-style sharing primitives without building them from scratch.
Filter what an agent can retrieve to the calling user's access.
One call to ask “can this subject do this on this resource?”
List what a user can access, or who can access a resource.
Define object types, relations, permissions, and caveats as code.
gRPC and HTTP clients in every major language, plus a first-class CLI.
Stream every relationship change to caches, search indexes, and pipelines.
ZedTokens give you read-your-writes correctness when you need it.
We'll sketch the schema with you live, from your real resources and roles.
Schedule a Demo