Access control systems often falter under heavy load, struggling with consistency and responsiveness. Ory Keto, based on Google Zanzibar, addresses this by delivering fine-grained authorization with minimal latency and strong consistency, even at high request volumes.
Fine-grained permissions, built for split-second decisions
Ory Keto is a distributed authorization server built on Google Zanzibar, supporting RBAC and ReBAC patterns from a single permissions API.
SDKs for any language and framework
Ory Keto is written in Go with official SDKs for every major language: Node.js, Python, Java, .NET, PHP, Ruby, and more. It works behind any framework and integrates with your existing data structures and identifiers without forcing a rewrite, so engineers can add fine-grained permissions fast.
Permission management & policy decision point
Resolve authorization decisions in real time through Keto's permissions API. Determine whether an entity (user, service, or Iot) is allowed to perform an action via HTTP/REST or gRPC, with Keto acting as the policy decision point for every microservice in your stack.
Authorization server powered by open-source
Ory Keto offers deployment flexibility. With open source roots, Ory Keto has grown to offer different models to suit your business needs. Deploy open-source, opt for Ory Enterprise License with additional features and support, or use the fully managed Ory Network for a seamless SaaS experience.
Akibur Rahman
System Architect
Ory components met modern technical standards, seamlessly integrated into our system, and were easily customizable to our needs.
Ory Keto features for fine-grained permissions at scale
Sub-10ms permission checks
Ory Keto is built on Google Zanzibar's principles and has sustained 95th-percentile latency under 10ms with greater than 99.99% availability across years of production use — fast enough to run synchronous authorization in the request path of every API call.
RBAC and ReBAC from one API
Mix authorization patterns within the same application without managing separate engines. Express role-based, attribute-based, list-based, and relationship-based access through a unified permissions API.
Global access control
Distribute permission checks across regions and clouds with consistency — write a permission update in one region and have it visible correctly anywhere in the world. Ory Network operates Ory Keto across global edge locations so authorization checks resolve close to your users, regardless of where you're deployed.
How to de-risk identity at scale with Ory
OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.
OSS
OEL
Ory Network
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
OSS: No
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Compliance-ready
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Ory Network: Yes
Global multi-region architecture
OSS: No
Global multi-region architecture
Multi-region capable
Global multi-region architecture
Ory Network: Yes
Purpose-based data retention
OSS: No
Purpose-based data retention
OEL: Yes
Purpose-based data retention
Ory Network: Yes
24/7 SLA support
OSS: No
24/7 SLA support
OEL: Yes
24/7 SLA support
Ory Network: Yes
CVE security patching
OSS: No
CVE security patching
OEL: Yes
CVE security patching
Ory Network: Yes
Unified control plane for ease of management
CLI
Unified control plane for ease of management
CLI & GUI
Unified control plane for ease of management
CLI & GUI
Production Helm Charts
OSS: No
Production Helm Charts
OEL: Yes
Production Helm Charts
n/a
Managed infrastructure
OSS: No
Managed infrastructure
n/a
Managed infrastructure
Ory Network: Yes
Concierge Onboarding
OSS: No
Concierge Onboarding
OEL: Yes
Concierge Onboarding
Ory Network: Yes
Optimized Permission Checks
OSS: No
Optimized Permission Checks
OEL: Yes
Optimized Permission Checks
Ory Network: Yes
OPA & RAG Integration
OSS: No
OPA & RAG Integration
OEL: Yes
OPA & RAG Integration
Ory Network: Yes
Deploy Ory Keto on your preferred infrastructure
Run the same authorization engine three ways — fully open source, self-hosted with a commercial license, or fully managed on Ory Network. Same APIs, same Zanzibar-based engine, same permission semantics across all three.
Open Source deployment — Run, try, and inspect Ory Keto open source. Perfect to proof-of-concept your next big idea. 
Ory Enterprise License
OEL deployment — Ory Keto on OEL means optimized code with premium support for mission-critical production environments, on-prem, self-hosted – wherever else you need it, always up to date. 
Ory Network
Ory Network deployment — Ory Network includes Ory Keto powered capabilities in an instant-on global identity system. Achieve speed, security, scale, compliance and support with ease.
Integrations
Ready to try Ory Keto?
Integrate Ory Keto with your existing stack in minutes. Quickstarts for Docker and Kubernetes, SDKs for every major language, and reference architectures for RBAC modeling.
policy.ts
import { Namespace, Context } from "@ory/keto-namespace-types"
class User implements Namespace {}
class Document implements Namespace {
related: {
owners: User[]
editors: User[]
viewers: User[]
parents: Folder[]
}
permits = {
view: (ctx: Context): boolean =>
this.related.viewers.includes(ctx.subject) ||
this.related.editors.includes(ctx.subject) ||
this.related.owners.includes(ctx.subject) ||
this.related.parents.traverse((parent) => parent.permits.view(ctx)),
}
}
class Folder implements Namespace {
related: {
owners: User[]
editors: User[]
viewers: User[]
parents: Folder[]
}
}
More on Keto
April 26, 2021
The evolution of Ory Keto: A global scale authorization system
Authorize billions of requests secure, consistent, low latency and no downtime using Ory Keto, the open source implementation of Google Zanzibar access control.
Ory Keto FAQ
Ory Keto is an authorization server that implements Google's Zanzibar research paper. It provides low-latency, relationship-based permission checks at scale. Ory Keto stores relationships between subjects (users, services, devices) and objects (documents, APIs, resources), then resolves permission checks by traversing those relationships. On the Ory Network, it powers the Ory Permissions service. Ory Keto is available as open-source software (Apache 2.0), under the Ory Enterprise License for self-hosted production, and as part of the fully managed Ory Network.
- Global Performance & Reliability - Ory Keto is designed for "split-second decision making," maintaining a 95th-percentile latency of less than 10ms and 99.99% availability. This ensures your application remains responsive and reliable even during massive traffic spikes, so you don’t miss opportunities.
- Operational Efficiency - By decoupling authorization from your application code, your developers can focus on building core product features rather than patching and maintaining homegrown identity infrastructure.
- De-Risking Identity at Scale - Ory Keto reduces the risk of security breaches and inconsistent permission checks. It provides a "unified control plane" that ensures consistent access policies across your entire ecosystem (users, AI agents, services, and IoT).
- Compliance Readiness - The platform is built to be audit-ready for global standards including GDPR, SOC 2, PCI-DSS, and PSD2, helping businesses meet regulatory requirements more easily.
Google Zanzibar is Google's internal authorization system, described in a 2019 research paper. It handles trillions of access control entries and millions of permission checks per second across Google products like Drive, Calendar, and Cloud. Ory Keto is the first and most widely adopted open-source implementation of the Zanzibar model. It adopts Zanzibar's core concepts: relation tuples as the data model, transitive relationship resolution, and the check/expand/list APIs. Ory Keto targets sub-10ms latency at the 95th percentile and scales horizontally.
Ory Keto supports multiple permission models through its relationship-based data structure. Relationship-Based Access Control (ReBAC) is the core model: permissions are encoded as relationships between subjects and objects. Role-Based Access Control (RBAC) is expressed by modeling roles as groups with membership relations. Access Control Lists (ACL) map directly to relation tuples. Attribute-Based Access Control (ABAC) is supported through the Ory Permission Language, which can evaluate conditions on subjects and objects. You can combine these models in a single system.
Ory Keto provides a "deploy-anywhere" authorization service that delivers trillion-scale performance and total flexibility. This allows global enterprises to eliminate vendor lock-in and secure their entire ecosystem of customers, partners, and AI agents. By consolidating identity infrastructure into easily deployable building blocks, Ory reduces total cost of ownership (TCO) and significantly accelerates time-to-market for mission-critical applications.
OPL is a configuration language for defining authorization rules. It uses a subset of TypeScript syntax, so most developers can read and write it without learning a new language. You define namespaces as classes, relations as typed arrays, and permissions as boolean functions that check membership or traverse relationships. OPL is intentionally not Turing-complete, which prevents infinite loops and resource exhaustion during permission evaluation. You can unit-test OPL rules with standard TypeScript tools like Jest.
Ory Keto exposes both REST and gRPC APIs. The Check API determines whether a subject has a specific relation to an object, resolving indirect relationships transitively. The Expand API recursively expands a subject set into a tree, showing who has access and why. The List API queries relationships by partial tuple, for example listing all users who can read a document. A batch check endpoint lets you evaluate multiple permission checks in a single request. All check requests support a configurable max-depth parameter to bound traversal and ensure low latency.
PostgreSQL, MySQL, and CockroachDB are supported for production. SQLite is supported for local development only. Ory Keto scales horizontally: add another container instance without additional configuration. On the Ory Network, the database layer is managed for you.
Ory Keto handles authorization (who can do what). Ory Kratos handles identity (who the user is). Ory Hydra handles delegation (OAuth2/OIDC token issuance). Ory Oathkeeper enforces access policies at the network edge. In a typical setup, Ory Kratos authenticates the user, Ory Oathkeeper validates the session, and Ory Keto decides whether the authenticated user has permission to access the requested resource. On the Ory Network, all four services are pre-integrated.
OPA (Open Policy Agent) and Casbin use a policy-as-code approach: you write rules in a domain-specific language (Rego for OPA) that evaluate against request context at decision time. Ory Keto uses a relationship-based approach: permissions are stored as data (relation tuples), and checks traverse that data graph. This means Ory Keto separates the permission data from the evaluation logic, which makes it easier to update permissions without redeploying policies.The Ory Permission Language uses TypeScript syntax rather than a proprietary language like Rego, so developers can use familiar tools and IDE support. OPL is also intentionally not Turing-complete, reducing the risk of performance issues from complex rules. The Zanzibar model that Ory Keto implements was designed for global scale: trillions of relationships and millions of checks per second.The trade-off is that Ory Keto is purpose-built for authorization, while OPA is a general-purpose policy engine that can also handle non-authorization decisions like admission control or configuration validation.
Yes. Ory Keto's relation tuple model naturally supports hierarchical permissions. You define parent-child relationships between folders and documents, then use the traverse function in OPL to inherit permissions through the hierarchy. For example, a user who has view access to a folder automatically gains view access to all documents in that folder. You can also model organization-level roles, team memberships, and resource-specific overrides. The Ory documentation includes examples of file sharing, document hierarchies, and multi-tenant SaaS permission models.
Ory Keto open source is free under the Apache 2.0 license. You can self-host it at no cost.On the Ory Network, permission checks are billed per API call. Each paid plan includes a monthly usage credit that offsets these costs. The Ory Network free Developer tier is available for testing and proof-of-concept work.For self-hosted production with SLAs, CVE patching, and enterprise features, the Ory Enterprise License is available at custom pricing.
