AuthZed

AuthZed 做的是权限这一层的基础设施，核心是开源的 SpiceDB，按 Google Zanzibar 那套关系模型实现：权限写成关系元组，比如某人在某文件夹上有编辑权，再通过 schema 声明继承规则，查询时按图走一遍得出能不能做。好处是权限逻辑从应用代码里抽出来，改策略不用发版，还能查「谁对这个资源有权限」这类反向问题。支持一致性级别选择、watch 变更流与多租户，官方云版按请求量计费。 ⭐ GitHub: authzed/spicedb — 7.2k stars 🔗 文档: https://authzed.com/docs

AuthZed builds the authorization layer, centred on the open-source SpiceDB, which implements Google's Zanzibar relationship model: permissions are written as relationship tuples, say a person edits a folder, inheritance rules are declared in a schema, and a query walks the graph to answer whether an action is allowed. The gain is that permission logic leaves application code, policy changes ship without a deploy, and reverse questions like who can access this resource become answerable. Consistency levels, a watch stream and multi-tenancy are supported, and the hosted service prices by request volume. ⭐ GitHub: authzed/spicedb — 7.2k stars 🔗 Docs: https://authzed.com/docs