The SpiceDB surge and choosing between Oso and OpenFGA

I see teams moving to SpiceDB because they need to resolve the permission drift that occurs when checks spread across microservices. The system uses a schema to define object types and relations, then uses relationships as the runtime data to answer the question, "can subject X perform action Y on resource Z?" Most applications start with a role column, but they eventually need to handle nested teams or per-document exceptions. I find the implementation of the OpenFGA consistency model to be coarser than the multi-mode ZedToken approach in SpiceDB. SpiceDB provides four per-request modes: minimize_latency, at_least_as_fresh, at_exact_snapshot, and fully_consistent. These modes use ZedTokens to manage point-in-time consistency and prevent the New Enemy Problem where stale data leaks access. I also find that answering transitive membership questions in SQL requires recursive queries whose cost grows with graph depth. If your permission graph is shallow and your services are few, the value of a graph traversal engine does not pay for itself. I would suggest checking if your deployment requires connection pooling, as the repository includes a pgbouncer variant for that reason. The README also mentions OWASP’s 2021 ranking of broken access control as a top web security risk, which provides motivation for moving logic into a centralized schema.

The market offers several alternatives to the Zanzibar model. OpenFGA provides CNCF governance for those who prioritize vendor neutrality. Oso handles RBAC, ABAC, and ReBAC through its Polar language. Cerbos uses stateless YAML policies to avoid a central relationship store. Permit.io provides a low-code experience for teams needing a visual UI. I would skip the open-source Oso library for any production environment because its active development moved to the proprietary Oso Cloud in December 2023, leaving the original repository as a deprecated component. You should evaluate if your team needs a dedicated datastore or if a library in your app process fits better. For teams that prioritize speed and attribute-based access, Cedar provides a fast, declarative option. I see a clear distinction between SpiceDB and OpenFGA in how they handle deployment and scale. SpiceDB is written in Go and ships as a single binary with support for CockroachDB, Postgres, MySQL, and Spanner. OpenFGA reached CNCF Incubating maturity in October 2025. I recommend using SpiceDB for complex hierarchies, while Oso remains better for SQL-level data filtering through Polar.

AuthZed released Materialize for the Dedicated tier on 10 September 2026 to solve the bottleneck of live traversal in deeply nested graphs. This tool precomputes transitive relationships for those needing speed at scale. I find the Enterprise tier necessary for teams requiring audit logging, rate limiting, or Security Embargo. The Security Embargo feature gives paying customers advance notice of vulnerabilities while open-source users wait for public disclosure. I also found the September 2026 cache-key flaw, CVE-2026-55866, to be a reason to check your deployment’s safety. This flaw, which carries a CVSS of 3.7, allowed SpiceDB to return a full permission grant where a conditional result was correct. Do the security implications of this cache-key flaw justify a complete migration to a different engine? I recommend using SpiceDB if your model relies on complex relationships, but stick to Oso if you need a unified model across roles, relationships, and attributes.