authzen

Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.

Purpose-bound authorization reference: RBAC + ABAC + ReBAC, row/field controls, fidelity gates, lifecycle governance, and a tested 100K synthetic-data path.

Keycloak integration with OpenFGA and Apache APISIX for multi-tenancy authentication and authorization at Scale

Observe AI agent runs and control consequential actions. Signed policies, exact-action approvals, AuthZEN API vetoes and evidence. MCP gateway today; connected-channel supervision and scoped reactions toward 1.0. Experimental alpha.

Actively maintained curated list of authorization and access control: policy engines (OPA, Cedar, Zanzibar/ReBAC), standards (AuthZEN, OAuth), AuthZ-as-a-Service, models, and real-world designs.

Frank!Gateway is an API gateway built for the specific needs of Dutch municipalities

This repository contains an extended version of OPA (OPA-AuthZEN) that implements the OpenID AuthZEN Authorization API 1.0.

Skills for coding agents

SPIFFE-compatible workload identity + OpenID AuthZEN 1.0 authorization in a single Apache-2.0 binary. Cedar PDP, SPIFFE federation, tamper-evident audit log, Kubernetes operator.

The Home-Mandate Specification: mandates for AI agents in the household, with schemas and conformance tests

NLgov AuthZEN is een standaard voor autorisatie. Het beschrijft de wijze waarop toegangsvragen en -beslissingen uitgewisseld worden tussen applicaties/API's en autorisatiesoftware

A Python library from Axiomatics to enable externalized authorization for AI applications using MCP, RAG, and A2A.

OpenFGA (ReBAC) example on Unikraft Cloud unikernels: private OpenFGA + PostgreSQL over .internal networking, a TypeScript API on Effect and the OpenFGA SDK, ~0.8 ms p50 checks.

De publieke website van het project Federatieve Toegangsverlening (FTV). FTV stelt standaarden voor in het kader van autorisatie, in het bijzonder in federatieve datastelsels.

A token procedure plugin enabling callout to an AuthZEN compliant authorizations service (PDP)

OpenID AuthZEN Authorization API for Policy Decision and Enforcement

Agent Trust — open profile + reference implementation for proving what an autonomous AI agent is authorized to do: identity, delegation with attenuation, proof-of-possession, attestations, tamper-evident provenance. Built on JWS, OAuth/OIDC, SPIFFE/WIMSE, AuthZEN, OpenID Federation, MCP and A2A.

Hands-on labs for securing AI agents and agentic protocols based open standards

Verifiable delegation for AI agents — signed chains rooted in a human sponsor, attenuating at every hop, revocable per link, and evaluated across whole action sequences.

Indykite — independent third-party profile of a public API surface, by API Evangelist. IndyKite is the runtime control layer for agentic AI. Its enterprise platform applies trust, context, and runtime control across organizational data so autonomous AI agents can act securely, continuously injecting live signals — identity, provenance, freshness, s