Application Security
Authorization libraries that check the object, not the role name (2026)
A 2026 shortlist of policy engines for the object id in your app. Public docs, not a lab bake-off.
Expertise: Application Security · Level: Intermediate · 12 min read
Is admin is not a check on invoice 8812.
The handler asked if the user was staff. The object id came from the URL. That is IDOR with a role name on top. These libraries put the object in the decision. The IDOR explainer stays on the blog. The BOLA fuzzer stays on the API list.
Six engines. One embeddable library. Two Zanzibar stores. One Polar policy. One AWS-shaped language. One general sidecar. Public docs and licenses. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Casbin | Embeddable ACL ABAC RBAC in-process | Apache-2.0 |
| OpenFGA | Open Zanzibar-style checks | Apache-2.0 |
| SpiceDB | Zanzibar-shaped store from Authzed | Apache-2.0 |
| Oso | Polar policies next to the app | Apache-2.0 (lib) / commercial cloud |
| Cedar | Amazon policy language you can run | Apache-2.0 |
| Open Policy Agent | Sidecar policy for more than the app | Apache-2.0 |
Casbin
Best for embeddable ACL ABAC RBAC in-process
Casbin is a library. Models are CONF. Policies are rows. Ports exist for Go, Java, Node, and others.
Key features
- Multiple model types
- Adapters for stores
- In-process check
- Apache-2.0
Why we like it
This is the hidden gem when you do not want a new network hop. The model file is the prove-it.
Limits
You still load the policy. A wrong model is a silent allow. It is not a hosted Zanzibar.
OpenFGA
Best for open Zanzibar-style checks
OpenFGA is a relationship store. Auth0/Okta opened it. Checks are ‘can user U do rel R on object O.’
Key features
- Relationship tuples
- HTTP and SDKs
- You can host it
- Modeled on Zanzibar ideas
Why we like it
When the org chart is the policy, a tuple store is the honest model. You can run it yourself.
Limits
You operate the store. Modeling is the hard part. It will not invent object-level checks you never wrote.
SpiceDB
Best for zanzibar-shaped store from Authzed
SpiceDB is Authzed’s Zanzibar-inspired database. The engine is Apache-2.0. Authzed Cloud is paid.
Key features
- Schema and relationships
- Consistency options
- Self-host or Authzed
- gRPC API
Why we like it
If you want the Google paper as running software, this is the open engine with a company behind it.
Limits
You still write the schema. Cloud is commercial. Latency is a new dependency.
Oso
Best for polar policies next to the app
Oso Polar is a policy language that can talk to your objects. The library is open. Oso Cloud is paid.
Key features
- Polar language
- Library in several languages
- Facts from your app
- Cloud option
Why we like it
When the policy must read a field on the invoice, Polar can say that without a second hop if you embed it.
Limits
Polar is a language your team must own. Cloud terms are commercial. Do not confuse the lib with the SaaS.
Cedar
Best for amazon policy language you can run
Cedar is Amazon’s policy language, open-sourced. Verified fragments exist. AWS uses it in Verified Permissions.
Key features
- Deterministic policy language
- Apache-2.0
- AWS Verified Permissions as a host
- Analysis tools in the repo
Why we like it
A policy language with a verification story is rare. You can run the engine without buying a SIEM.
Limits
The AWS service is a different bill. Embedding Cedar is on you. It is not a drop-in for a legacy RBAC table.
Open Policy Agent
Best for sidecar policy for more than the app
OPA evaluates Rego. It started as a sidecar for clusters and APIs. It can decide an HTTP request if you feed it the input.
Key features
- Rego language
- Sidecar or library
- Same engine as Gatekeeper
- Apache-2.0
Why we like it
If the decision must be the same in CI, on the gateway, and in the app, one engine is the point. Link Platform for admission.
Limits
Rego is easy to write badly. A sidecar is a hop. This is not a user directory.
What the internet thinks about authorization libraries
OpenFGA threads treat the mapping table as the thing that rots. A role column is not an object check.
ants_everywhere on Hacker News, Oct 2025: “Usually users map into groups, groups are subgroups of each other, and permissions are granted to groups.”
Prove Casbin is still a module
Check that the Casbin Go module still resolves. You should get a version list, not a 404.
curl -fsSIL https://casbin.org/ | head -n 5
curl -fsS https://proxy.golang.org/github.com/casbin/casbin/v2/@latest | head -c 200FAQs
Does a library replace object-level tests?
No. The library is the decision. You still write a test that uses another user’s id. Link the IDOR guide.
Is OPA an IdP?
No. OPA does not log anyone in. Identity owns the session. This page owns the object check.
Should I pick Zanzibar or Polar?
Zanzibar if the graph is the product. Polar or Casbin if the check must stay in the request path without a new store.
Is this a scored bake-off?
No. Order is editorial. We did not load-test the stores.
