Ory Keto

Ory Keto is an open source authorization server that implements Google Zanzibar's access control model. The system provides permission and authorization services through gRPC and REST APIs, supporting RBAC (Role-Based Access Control), ABAC (Attribute-Based Access Control), and ACL (Access Control Lists). The authorization server is written in Go and offers SDKs for multiple programming languages. It integrates with existing data structures and identifiers, working behind any framework. The system performs permission checks to determine if entities (users, services, IoT devices) are allowed to perform specific actions. Ory Keto maintains low latency with 95th-percentile response times under 10ms and availability exceeding 99.99% in production environments. The system handles high request volumes while maintaining strong consistency across distributed deployments. The product offers three deployment models: open source self-hosted deployment, Ory Enterprise License (OEL) with additional features and support, and Ory Network as a fully managed SaaS solution. The authorization system can be deployed globally to provide fast response times regardless of user location. Ory Keto uses the Ory Permission Language for defining authorization policies, allowing developers to specify relationships between users, resources, and permissions through code-based policy definitions.