Skip to content

Compare

Permio vs OpenFGA

OpenFGA and Permio both answer “can this user do this on that object?”. OpenFGA models any relationship graph with tuples and a modelling language; Permio uses one opinionated model, roles granted on resource paths, and runs it for you.

Facts about OpenFGA as of October 2026, from its official site and docs (sources below). Corrections welcome.

What OpenFGA is

OpenFGA describes itself as “a scalable open source authorization system for developers”, inspired by Google’s Zanzibar and based on relationship-based access control (ReBAC), with conditions for attribute-based rules.[1] It is Apache-2.0 licensed and a Cloud Native Computing Foundation project, at the Incubating level since October 2025.[2][3]

You write an authorization model in the OpenFGA modelling language (types, relations and how relations derive from each other) and store relationship tuples such as {user, relation, object}.[4] The server exposes HTTP and gRPC APIs, stores data in PostgreSQL, MySQL or SQLite, and is self-hosted with Docker or Kubernetes.[2][5] Auth0 FGA is a managed service built on OpenFGA, adding a dashboard, multi-region replication and enterprise support.[6]

What Permio is

Permio is a hosted permissions API. Resources are paths such as /projects/123/docs/9; you grant roles (bundles of permissions like document.read) to principals or groups on a path, and the grant covers everything below it. Your backend asks “can this principal do this here?” and gets allowed or denied. It works alongside whatever login you use. We’re early: the TypeScript SDK is public on npm, and paid pricing isn’t published yet.

How the models differ

  • Hierarchy. In OpenFGA, inheritance is something you model: a relation such as parent plus tuples linking each document to its folder, kept in sync as data moves.[4] In Permio the hierarchy is the resource path itself, so a grant on /projects/123 covers /projects/123/docs/9 with nothing extra to write.
  • Expressiveness. OpenFGA can express arbitrary graphs: multiple parents, relations computed from other relations, and conditions evaluated with CEL.[4][7] Permio deliberately supports one shape (a tree of paths, roles, groups and a single-segment wildcard) and has no attribute conditions.
  • Operations. Self-hosted OpenFGA means running the server and its database; Auth0 FGA removes that.[5][6] Permio is only available as a hosted API.
  • Queries. OpenFGA offers Check, BatchCheck, ListObjects and ListUsers.[8] Permio offers Check, BatchCheck, ListAccess (returned as path prefixes for a database filter) and ListPrincipalsWithAccess.

At a glance

Permio and OpenFGA compared, as of October 2026
PermioOpenFGA
ModelRoles and permissions granted on hierarchical resource paths (e.g. /projects/123), inherited by everything below; groups; _ matches one segmentReBAC: authorization model in a modelling language plus relationship tuples; CEL conditions[4][7]
HostingManaged API hosted by Permio (Google Cloud, London). No self-hosted option todaySelf-hosted (Docker, Kubernetes) or managed via Auth0 FGA[5][6]
Open sourceTypeScript SDK (MIT) and Rust client are open source; the service itself is notServer is Apache-2.0; CNCF Incubating project[2][3]
List filteringlistAccess returns scopes you turn into a SQL, Prisma or MongoDB filterListObjects and StreamedListObjects[8]
Who has accesswhoHasAccess (ListPrincipalsWithAccess), including members via groupsListUsers[8]
SDKsTypeScript on npm; REST (JSON) and gRPC / gRPC-web for any language; Rust client. Go and Python comingJava, .NET, JavaScript, Go, Python, plus a CLI[1]
DashboardDashboard with an Access tester (why a check was allowed) and an audit log of changesPlayground for modelling; no dashboard in self-hosted OpenFGA (Auth0 FGA has one)[2][6]
PricingFree to start, no credit card. Paid plans not yet publishedOpenFGA is free; Auth0 FGA has a free trial tier and enterprise contracts[6][9]

When to choose which

Choose OpenFGA if

  • You need relationships that aren’t a tree: several parents, relations derived from other relations, or attribute conditions.
  • You want to self-host an open-source, CNCF-governed engine, or need official SDKs for Java, .NET, Go or Python today.[1]
  • You need the scale, replication and enterprise support that Auth0 FGA offers.[6]

Choose Permio if

  • Your resources already form a hierarchy (tenants, workspaces, projects, folders, documents) and you want inheritance without modelling it.
  • You want a hosted API with a dashboard, an Access tester and an audit log, without running a database or authoring a model.
  • You work in TypeScript, or are happy calling REST or gRPC directly.

Want to see whether Permio’s model fits your app? The quickstart takes a few minutes, and it’s free to start.

Start free Read the docs

Sources

Fetched October 2026.

  1. OpenFGA: Introduction: https://openfga.dev/docs/fga
  2. OpenFGA on GitHub: https://github.com/openfga/openfga
  3. CNCF: OpenFGA project page: https://www.cncf.io/projects/openfga/
  4. OpenFGA: Modeling getting started: https://openfga.dev/docs/modeling/getting-started
  5. OpenFGA: Setup overview: https://openfga.dev/docs/getting-started/setup-openfga/overview
  6. Auth0 FGA: OpenFGA vs Auth0 FGA: https://docs.fga.dev/openfga-vs-auth0-fga
  7. OpenFGA: Conditions: https://openfga.dev/docs/modeling/conditions
  8. OpenFGA docs index (llms.txt): https://openfga.dev/docs/llms.txt
  9. Auth0 FGA: Subscription plans: https://docs.fga.dev/subscription-plans

Other comparisons