SpiceDB | AuthZed

Base Layer EP 03: Spencer Kimball on Governance Is the Real Blocker

SpiceDB / Open-source Google Zanzibar
The standard for building authz services

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions.

Learn the basics
Explore on GitHub

Learn key concepts

Define a Permissions Schema
Define types of objects, how those objects relate to one another, and the permissions that can be computed from those relationships.
Integrate Your Applications
Integrate with your application using official and community supported client libraries or make requests to the HTTP API endpoint.
Test and Deploy
Use provided tooling to develop and validate schema changes. Use the built-in testing server to run real API calls against test data.

Define authorization as schema

Design tailored authorization systems by defining relationships, permissions based on those relationships, and bits of policy called Caveats.

Features

SpiceDB is the open-source, Google Zanzibar-inspired permissions database used to build fine-grained authorization services at scale.

Expressive APIs
Expressive gRPC and HTTP/JSON APIs for powering authorization logic in your client applications.
Distributed Graph
Distributed, parallel graph engine faithful to the architecture described in Google's Zanzibar paper.
Prevents New Enemies
A flexible consistency model configurable per-request that includes resistance to the New Enemy Problem.
Configuration Language
Intuitive authorization configuration language — SpiceDB Schema — with CI/CD integrations for validation & testing.
Pluggable Storage
Support for in-memory, Spanner, CockroachDB, PostgreSQL, and MySQL relationship storage.
Deep Observability
Deep observability with Prometheus metrics, pprof profiles, structured logging, and OpenTelemetry tracing.

The toolkit

Everything you need to deploy, manage, and integrate SpiceDB.

SpiceDB Operator

Optimize your Day 1 and Day 2 operations with our official Kubernetes SpiceDB Operator.

kubectl apply -f spicedbcluster.yaml — create, manage, and scale SpiceDB clusters with a single Kubernetes resource.
Zero-downtime datastore migrations — run painless migrations regardless of your backing datastore or SpiceDB version.
Automated update channels — configure clusters to follow release channels and automatically roll out updates.

authzed/spicedb-operator Public

zed CLI

The easiest way to interact with your SpiceDB Deployments.

Context switching — securely change environments with credentials stored in your OS keychain.
Full RPC support — leverage all of SpiceDB's RPCs from your command-line.
Easy testing — validate your schema and test assertions with zed validate.

authzed/zed Public

Awesome SpiceDB

A thriving, open ecosystem of official and community programs and libraries used to interact with SpiceDB.

Official libraries — get started with official Go, Java, NodeJS, Python, and Ruby client libraries.
Community libraries — leverage additional libraries built and maintained by the SpiceDB community.
Integrations — browse additional integrations for examples of projects that integrate with SpiceDB.

authzed/awesome-spicedb Public