6e32& | Google Zanzibar vs OPA - Graph vs. Code Based Authorization | Permit
https://www.permit.io/blog/zanzibar-vs-opa
Saved on 2023-07-01 [19539 edays] via permit.io
Modified 2023-08-06 [19575 edays]
authorization programming

Property Graph-Based Authorization Policy-as-Code Authorization
Nature of Access Control Natural fit for Relationship-based Access Control (ReBAC) Excels at managing complex policies (e.g., ABAC)
Representation of Relationships Excellent for representing hierarchies and nested relationships Flexible and can manage complex relationships, but not inherently hierarchical
Data Volume Management Manages high volumes of data consistently Can struggle with large amounts of data without sharding
Reverse Indices Supports reverse indices Does not support reverse indices
Performance Lower performance compared to policy-as-code Generally high performance
Deployment at Edge Practically impossible due to size Feasible and efficient
Latency Higher due to non-locality Lower due to local deployment
Ease of Updates Less flexible for updates Highly flexible and easy to update
Ecosystem Emerging ecosystem Robust ecosystem with plugins and multiple engines
Learning Curve Moderate Can be high due to complex languages