authzen

Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.

Purpose-bound authorization reference: RBAC + ABAC + ReBAC, row/field controls, fidelity gates, lifecycle governance, and a tested 100K synthetic-data path.

Keycloak integration with OpenFGA and Apache APISIX for multi-tenancy authentication and authorization at Scale

Observe AI agent runs and control consequential actions. Signed policies, exact-action approvals, AuthZEN API vetoes and evidence. MCP gateway today; connected-channel supervision and scoped reactions toward 1.0. Experimental alpha.

Actively maintained curated list of authorization and access control: policy engines (OPA, Cedar, Zanzibar/ReBAC), standards (AuthZEN, OAuth), AuthZ-as-a-Service, models, and real-world designs.

Frank!Gateway is an API gateway built for the specific needs of Dutch municipalities

This repository contains an extended version of OPA (OPA-AuthZEN) that implements the OpenID AuthZEN Authorization API 1.0.

Skills for coding agents

SPIFFE-compatible workload identity + OpenID AuthZEN 1.0 authorization in a single Apache-2.0 binary. Cedar PDP, SPIFFE federation, tamper-evident audit log, Kubernetes operator.

The Home-Mandate Specification: mandates for AI agents in the household, with schemas and conformance tests

A Python library from Axiomatics to enable externalized authorization for AI applications using MCP, RAG, and A2A.

NLgov AuthZEN is een standaard voor autorisatie. Het beschrijft de wijze waarop toegangsvragen en -beslissingen uitgewisseld worden tussen applicaties/API's en autorisatiesoftware

OpenFGA (ReBAC) example on Unikraft Cloud unikernels: private OpenFGA + PostgreSQL over .internal networking, a TypeScript API on Effect and the OpenFGA SDK, ~0.8 ms p50 checks.

De publieke website van het project Federatieve Toegangsverlening (FTV). FTV stelt standaarden voor in het kader van autorisatie, in het bijzonder in federatieve datastelsels.

A token procedure plugin enabling callout to an AuthZEN compliant authorizations service (PDP)

Agent Trust — open profile + reference implementation for proving what an autonomous AI agent is authorized to do: identity, delegation with attenuation, proof-of-possession, attestations, tamper-evident provenance. Built on JWS, OAuth/OIDC, SPIFFE/WIMSE, AuthZEN, OpenID Federation, MCP and A2A.

Hands-on labs for securing AI agents and agentic protocols based open standards

Verifiable delegation for AI agents — signed chains rooted in a human sponsor, attenuating at every hop, revocable per link, and evaluated across whole action sequences.

OpenID AuthZEN Authorization API for Policy Decision and Enforcement

MCP server giving LLM agents real authorization answers: evaluate Rego in-process via OPA, or ask an OpenID AuthZEN 1.0 PDP