The CNCF Technical Oversight Committee (TOC) has voted to accept OpenFGA as a CNCF incubating project.
What is OpenFGA?
OpenFGA is an authorization engine that addresses the challenge of implementing complex access control at scale in modern software applications. Inspired by Google’s global access control system, Zanzibar, OpenFGA leverages Relationship-Based Access Control (ReBAC). This allows developers to define permissions based on relationships between users and objects (e.g., who can view which document). By serving as an external service with an API and multiple SDKs, it centralizes and abstracts the authorization logic out of the application code. This separation of concerns significantly improves developer velocity by simplifying security implementation and ensures that access rules are consistent, scalable, and easy to audit across all services, solving a critical complexity problem for developers building distributed systems.
OpenFGA’s History
OpenFGA was developed by a group of Okta employees, and is the foundation for the Auth0 FGA commercial offering.
The project was accepted as a CNCF Sandbox project in September 2022. Since then, it has been deployed by hundreds of companies and received multiple contributions. Some major moments and updates include:
- 37 companies publicly acknowledge using it in production.
- Engineers from Grafana Labs and GitPod have become official maintainers.
- OpenFGA was invited to present on the Maintainer’s track at Kubecon + CloudNativeCon Europe 2025.
- A MySQL storage adapter was contributed by TwinTag and SQLite storage adapter was contributed by Grafana Labs.
- OpenFGA started hosting a monthly OpenFGA community meeting in April 2023
- Several developer experience improvements, like:
- New SDKs for Python and Java
- IDE integrations with VS Code and IntelliJ
- A CLI with support for model testing
- A Terraform Provider was donated to the project by Maurice Ackel
- A new caching implementation and multiple performance improvements shipped over the last year.
- OpenFGA also added the ListObjects endpoint to retrieve all resources a user has a specific relation with a resource. Additionally, OpenFGA added the ListUsers endpoint to retrieve all users that have a specific relation with a resource.
Further, OpenFGA integrates with multiple CNCF projects:
- OpenTelemetry for tracing and telemetry
- Helm for deployment
- Grafana dashboards for monitoring
- Prometheus for metrics collection
- ArtifactHub for Helm chart distribution
Maintainer Perspective
“Seeing companies successfully deploy OpenFGA in production demonstrates its viability as an authorization solution. Our focus now is on growth. CNCF Incubation provides increased credibility and visibility – attracting a broader set of contributors and helping secure long-term sustainability. We anticipate this phase supporting us collectively build the definitive and centralized service for fine-grained authorization that the cloud native ecosystem can continue to trust.
— Andres Aguiar, OpenFGA Maintainer and Director of Product at Okta
“When Grafana adopted OpenFGA the community was incredibly welcoming, and we’ve been fortunate to collaborate on enhancements like SQLite support. We are excited to work with CNCF to continue the evolution of the OpenFGA platform.”
— Dan Cech, Distinguished Engineer, Grafana Labs
From the TOC
“Authorization is one of the most complex and critical problems in distributed systems, and OpenFGA provides a clean, scalable solution that developers can actually adopt. Its ReBAC model and API-first approach simplify how teams think about access control, removing layers of custom logic from applications. What impressed me most during the due diligence process was the project’s momentum—strong community growth, diverse maintainers, and real-world production deployments. OpenFGA is quickly becoming a foundational building block for secure, cloud native applications.”
— Ricardo Aravena, CNCF TOC Sponsor
“As the TOC Sponsor for OpenFGA’s incubation, I’ve had the opportunity to work closely with the maintainers and see their deep technical rigor and commitment to excellence firsthand. OpenFGA reflects the kind of thoughtful engineering and collaboration that drives the CNCF ecosystem forward. By externalizing authorization through a developer-friendly API, OpenFGA empowers teams to scale security with the same agility as their infrastructure. Throughout the incubation process, the maintainers have been exceptionally responsive and precise in addressing feedback, demonstrating the project’s maturity and readiness for broader adoption. With growing adoption and strong technical foundations, I’m excited to see how the OpenFGA community continues to expand its capabilities and help organizations strengthen access control across cloud native environments.”
— Faseela Kundattil, CNCF TOC Sponsor
Main Components
Some main components of the project include:
- The OpenFGA server designed to answer authorization requests fast and at scale
- SDKs for Go, .NET, JS, Java, Python
- A CLI to interact with the OpenFGA server and test authorization models
- Helm Charts to deploy to Kubernetes
- Integrations with VS Code and Jetbrains
Notable Milestones
- 4,300+ GitHub Stars
- 2246 Pull Requests
- 459 Issues
- 96 Contributors, 652 across repositories
- 89 Releases
Looking Ahead
OpenFGA is a database, and as with any database, there will always be work to improve performance for every type of query. Future goals of the roadmap are to make it simpler for maintainers to contribute to SDKs; launch new SDKs for Ruby, Rust, and PHP; add support for the AuthZen standard; add new visualization options and open sourcing the OpenFGA playground tool; improve observability; add streaming API endpoints for better performance; and include more robust error handling with new write-conflict options.
You can learn more about OpenFGA here.
As a CNCF-hosted project, OpenFGA is part of a neutral foundation aligned with its technical interests, as well as the larger Linux Foundation, which provides governance, marketing support, and community outreach. OpenFGA joins incubating technologies Backstage, Buildpacks, cert-manager, Chaos Mesh, CloudEvents, Container Network Interface (CNI), Contour, Cortex, CubeFS, Dapr, Dragonfly, Emissary-Ingress, Falco, gRPC, in-toto, Keptn, Keycloak, Knative, KubeEdge, Kubeflow, KubeVela, KubeVirt, Kyverno, Litmus, Longhorn, NATS, Notary, OpenFeature, OpenKruise, OpenMetrics, OpenTelemetry, Operator Framework, Thanos, and Volcano. For more information on maturity requirements for each level, please visit the CNCF Graduation Criteria.