authzen

Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.

Purpose-bound authorization reference: RBAC + ABAC + ReBAC, row/field controls, fidelity gates, lifecycle governance, and a tested 100K synthetic-data path.

Keycloak integration with OpenFGA and Apache APISIX for multi-tenancy authentication and authorization at Scale

Observe AI agent runs and control consequential actions. Signed policies, exact-action approvals, AuthZEN API vetoes and evidence. MCP gateway today; connected-channel supervision and scoped reactions toward 1.0. Experimental alpha.

Actively maintained curated list of authorization and access control: policy engines (OPA, Cedar, Zanzibar/ReBAC), standards (AuthZEN, OAuth), AuthZ-as-a-Service, models, and real-world designs.

Frank!Gateway is an API gateway built for the specific needs of Dutch municipalities

This repository contains an extended version of OPA (OPA-AuthZEN) that implements the OpenID AuthZEN Authorization API 1.0.

Skills for coding agents

SPIFFE-compatible workload identity + OpenID AuthZEN 1.0 authorization in a single Apache-2.0 binary. Cedar PDP, SPIFFE federation, tamper-evident audit log, Kubernetes operator.

A Python library from Axiomatics to enable externalized authorization for AI applications using MCP, RAG, and A2A.

NLgov AuthZEN is een standaard voor autorisatie. Het beschrijft de wijze waarop toegangsvragen en -beslissingen uitgewisseld worden tussen applicaties/API's en autorisatiesoftware

OpenFGA (ReBAC) example on Unikraft Cloud unikernels: private OpenFGA + PostgreSQL over .internal networking, a TypeScript API on Effect and the OpenFGA SDK, ~0.8 ms p50 checks.

De publieke website van het project Federatieve Toegangsverlening (FTV). FTV stelt standaarden voor in het kader van autorisatie, in het bijzonder in federatieve datastelsels.

A token procedure plugin enabling callout to an AuthZEN compliant authorizations service (PDP)

OpenID AuthZEN Authorization API for Policy Decision and Enforcement

Agent Trust — open profile + reference implementation for proving what an autonomous AI agent is authorized to do: identity, delegation with attenuation, proof-of-possession, attestations, tamper-evident provenance. Built on JWS, OAuth/OIDC, SPIFFE/WIMSE, AuthZEN, OpenID Federation, MCP and A2A.

Hands-on labs for securing AI agents and agentic protocols based open standards

Verifiable delegation for AI agents — signed chains rooted in a human sponsor, attenuating at every hop, revocable per link, and evaluated across whole action sequences.

MCP server giving LLM agents real authorization answers: evaluate Rego in-process via OPA, or ask an OpenID AuthZEN 1.0 PDP

Mission Composition Profile for AuthZEN, with an implementation and conformance suite, based on Ordered k-tuple soundness from Bounded Agents.