All 25 Dependencies
Every package SpiceDB depends on, ranked by repo health score.
SpiceDB is an open source database purpose-built for one job: answering "can subject X perform action Y on resource Z?" quickly and correctly, no matter how large the dataset or how complex the permission model. It is the most mature open implementation of Google's internal Zanzibar system, the paper that describes how Google powers access control for Calendar, Drive, Photos, and Cloud IAM. Rather than bolting authorization onto an existing relational or key-value store, SpiceDB is a dedicated service that developers define a schema against, write relationship tuples into, and query through gRPC or HTTP client libraries.
The core model is relationship-based access control (ReBAC): developers write a schema describing object types (documents, folders, organizations) and the relations between them (viewer, editor, parent), then SpiceDB computes permissions by walking that relationship graph — for example, a user can view a document if they are a direct viewer, or if they can view the folder that contains it. SpiceDB extends this with caveated relationships, which attach CEL (Common Expression Language) conditions to a relationship so a grant can depend on runtime context like IP range, time of day, or resource attributes — effectively blending ReBAC with attribute-based access control (ABAC) in a single system.
Operationally, SpiceDB is built to run as a centralized authorization service shared across microservices, with pluggable storage backends (PostgreSQL, MySQL, CockroachDB, Google Cloud Spanner, or in-memory for development) sitting behind a common datastore interface, and a distributed dispatch layer that uses consistent hashing to route permission checks across a cluster while keeping cache hit rates high. Per-request consistency tuning (via "zedtokens") lets callers choose between fully consistent reads and faster, slightly stale ones, which is how AuthZed advertises 5ms p95 latency at millions of queries per second.
SpiceDB is maintained by AuthZed, which also sells a hosted cloud version, but the open source project itself carries no license-gated features. It has been adopted by organizations including IBM, Red Hat, and GitPod for exactly the problem it was built to solve: keeping authorization logic out of application code and correct as systems scale.
