Access control systems often falter under heavy load, struggling with consistency and responsiveness. Ory Keto, based on Google Zanzibar, addresses this by delivering fine-grained authorization with minimal latency and strong consistency, even at high request volumes.
Fine-grained permissions, built for split-second decisions
Ory Keto is a distributed authorization server built on Google Zanzibar, supporting RBAC and ReBAC patterns from a single permissions API.
SDKs for any language and framework
Ory Keto is written in Go with official SDKs for every major language: Node.js, Python, Java, .NET, PHP, Ruby, and more. It works behind any framework and integrates with your existing data structures and identifiers without forcing a rewrite, so engineers can add fine-grained permissions fast.
Permission management & policy decision point
Resolve authorization decisions in real time through Keto's permissions API. Determine whether an entity (user, service, or Iot) is allowed to perform an action via HTTP/REST or gRPC, with Keto acting as the policy decision point for every microservice in your stack.
Authorization server powered by open-source
Ory Keto offers deployment flexibility. With open source roots, Ory Keto has grown to offer different models to suit your business needs. Deploy open-source, opt for Ory Enterprise License with additional features and support, or use the fully managed Ory Network for a seamless SaaS experience.
Akibur Rahman
System Architect
Ory components met modern technical standards, seamlessly integrated into our system, and were easily customizable to our needs.
Ory Keto features for fine-grained permissions at scale
Sub-10ms permission checks
Ory Keto is built on Google Zanzibar's principles and has sustained 95th-percentile latency under 10ms with greater than 99.99% availability across years of production use — fast enough to run synchronous authorization in the request path of every API call.
RBAC and ReBAC from one API
Mix authorization patterns within the same application without managing separate engines. Express role-based, attribute-based, list-based, and relationship-based access through a unified permissions API.
Global access control
Distribute permission checks across regions and clouds with consistency — write a permission update in one region and have it visible correctly anywhere in the world. Ory Network operates Ory Keto across global edge locations so authorization checks resolve close to your users, regardless of where you're deployed.
How to de-risk identity at scale with Ory
OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.
Ory Open Source
Continuous Security License
Ory Enterprise License
Ory Network
Cross-platform benefits
Cross-platform benefits
Cross-platform benefits
Cross-platform benefits
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Ory Open Source: No
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Continuous Security License: No
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Compliance-ready
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Ory Network: Yes
Global multi-region architecture
Ory Open Source: No
Global multi-region architecture
Continuous Security License: No
Global multi-region architecture
Multi-region capable
Global multi-region architecture
Ory Network: Yes
Purpose-based data retention
Ory Open Source: No
Purpose-based data retention
Continuous Security License: No
Purpose-based data retention
Ory Enterprise License: Yes
Purpose-based data retention
Ory Network: Yes
24/7 SLA support
Ory Open Source: No
24/7 SLA support
Continuous Security License: No
24/7 SLA support
Ory Enterprise License: Yes
24/7 SLA support
Ory Network: Yes
CVE security patching
Ory Open Source: No
CVE security patching
Continuous Security License: Yes
CVE security patching
Ory Enterprise License: Yes
CVE security patching
Ory Network: Yes
Unified control plane for ease of management
Ory Open Source: CLI
Unified control plane for ease of management
Continuous Security License: CLI
Unified control plane for ease of management
Ory Enterprise License: CLI / GUI
Unified control plane for ease of management
Ory Network: CLI / GUI / Terraform provider
Software Bill of Materials
Ory Open Source: Yes
Software Bill of Materials
Continuous Security License: Yes
Software Bill of Materials
Ory Enterprise License: Yes
Software Bill of Materials
Ory Network: Yes
Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)
Ory Open Source: No
Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)
Continuous Security License: Yes
Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)
Ory Enterprise License: Yes
Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)
Ory Network: Yes
Production Helm Charts
Ory Open Source: No
Production Helm Charts
Continuous Security License: No
Production Helm Charts
Ory Enterprise License: Yes
Production Helm Charts
n/a
Managed infrastructure
Ory Open Source: No
Managed infrastructure
Continuous Security License: No
Managed infrastructure
n/a
Managed infrastructure
Ory Network: Yes
Support Ticketing System
Ory Open Source: No
Support Ticketing System
Continuous Security License: No
Support Ticketing System
Ory Enterprise License: Yes
Support Ticketing System
Ory Network: Yes
Concierge onboarding
Ory Open Source: No
Concierge onboarding
Continuous Security License: No
Concierge onboarding
Ory Enterprise License: Yes
Concierge onboarding
Ory Network: Yes
Dedicated slack channel
Ory Open Source: No
Dedicated slack channel
Continuous Security License: No
Dedicated slack channel
Ory Enterprise License: Yes
Dedicated slack channel
Ory Network: Yes
Premium Features
Ory Open Source: No
Premium Features
Continuous Security License: No
Premium Features
Ory Enterprise License: Yes
Premium Features
Ory Network: Yes
Permissions - Ory Keto
Permissions - Ory Keto
Permissions - Ory Keto
Permissions - Ory Keto
Concierge Onboarding
Ory Open Source: No
Concierge Onboarding
Continuous Security License: No
Concierge Onboarding
Ory Enterprise License: Yes
Concierge Onboarding
Ory Network: Yes
Optimized Permission Checks
Ory Open Source: No
Optimized Permission Checks
Continuous Security License: No
Optimized Permission Checks
Ory Enterprise License: Yes
Optimized Permission Checks
Ory Network: Yes
OPA & RAG Integration
Ory Open Source: No
OPA & RAG Integration
Continuous Security License: No
OPA & RAG Integration
Ory Enterprise License: Yes
OPA & RAG Integration
Ory Network: Yes
Managing Identities - Ory Kratos
Managing Identities - Ory Kratos
Managing Identities - Ory Kratos
Managing Identities - Ory Kratos
High performance pooling
Ory Open Source: No
High performance pooling
Continuous Security License: No
High performance pooling
Ory Enterprise License: Yes
High performance pooling
Ory Network: Yes
B2B Organizations
Ory Open Source: No
B2B Organizations
Continuous Security License: No
B2B Organizations
Ory Enterprise License: Yes
B2B Organizations
Ory Network: Yes
Admin onboarding portal
Ory Open Source: No
Admin onboarding portal
Continuous Security License: No
Admin onboarding portal
Ory Enterprise License: Yes
Admin onboarding portal
Ory Network: Yes
Social single sign-on
Ory Open Source: Yes
Social single sign-on
Continuous Security License: Yes
Social single sign-on
Ory Enterprise License: Yes
Social single sign-on
Ory Network: Yes
Purpose-based data retention
Ory Open Source: No
Purpose-based data retention
Continuous Security License: No
Purpose-based data retention
Ory Enterprise License: Yes
Purpose-based data retention
Ory Network: Yes
CAPTCHA
Ory Open Source: No
CAPTCHA
Continuous Security License: No
CAPTCHA
Ory Enterprise License: Yes
CAPTCHA
Ory Network: Yes
FedCM
Ory Open Source: No
FedCM
Continuous Security License: No
FedCM
Ory Enterprise License: Yes
FedCM
Ory Network: Yes
Advanced identity search
Ory Open Source: No
Advanced identity search
Continuous Security License: No
Advanced identity search
Ory Enterprise License: Yes
Advanced identity search
Ory Network: Yes
Authorization (Certified OAuth2/OIDC) - Ory Hydra
Authorization (Certified OAuth2/OIDC) - Ory Hydra
Authorization (Certified OAuth2/OIDC) - Ory Hydra
Authorization (Certified OAuth2/OIDC) - Ory Hydra
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
Ory Open Source: Yes
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
Continuous Security License: Yes
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
Ory Enterprise License: Yes
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
Ory Network: Yes
OpenID Certified®
Ory Open Source: Yes
OpenID Certified®
Continuous Security License: Yes
OpenID Certified®
Ory Enterprise License: Yes
OpenID Certified®
Ory Network: Yes
High performance pooling
Ory Open Source: No
High performance pooling
Continuous Security License: No
High performance pooling
Ory Enterprise License: Yes
High performance pooling
Ory Network: Yes
Stateless JWT access tokens
Ory Open Source: No
Stateless JWT access tokens
Continuous Security License: No
Stateless JWT access tokens
Ory Enterprise License: Yes
Stateless JWT access tokens
Ory Network: Yes
Credential rotation
Ory Open Source: No
Credential rotation
Continuous Security License: No
Credential rotation
Ory Enterprise License: Yes
Credential rotation
Ory Network: Yes
Token exchange
Ory Open Source: No
Token exchange
Continuous Security License: No
Token exchange
Ory Enterprise License: Yes
Token exchange
Ory Network: Yes
Resource Owner Password Credentials (ROPC)
Ory Open Source: No
Resource Owner Password Credentials (ROPC)
Continuous Security License: No
Resource Owner Password Credentials (ROPC)
Ory Enterprise License: Yes
Resource Owner Password Credentials (ROPC)
Ory Network: Yes
B2B Federation - Ory Polis
B2B Federation - Ory Polis
B2B Federation - Ory Polis
B2B Federation - Ory Polis
Custom Branding for Onboarding Portal
Ory Open Source: No
Custom Branding for Onboarding Portal
Continuous Security License: No
Custom Branding for Onboarding Portal
Ory Enterprise License: Yes
Custom Branding for Onboarding Portal
Ory Network: Yes
SAML & OIDC
Ory Open Source: No
SAML & OIDC
Continuous Security License: No
SAML & OIDC
Ory Enterprise License: Yes
SAML & OIDC
Ory Network: Yes
Directory sync
Ory Open Source: No
Directory sync
Continuous Security License: No
Directory sync
Ory Enterprise License: Yes
Directory sync
Ory Network: Yes
Identity federation
Ory Open Source: No
Identity federation
Continuous Security License: No
Identity federation
Ory Enterprise License: Yes
Identity federation
Ory Network: Yes
Deploy Ory Keto on your preferred infrastructure
Run the same authorization engine three ways — fully open source, self-hosted with a commercial license, or fully managed on Ory Network. Same APIs, same Zanzibar-based engine, same permission semantics across all three.
Open Source deployment — Run, try, and inspect Ory Keto open source. Perfect to proof-of-concept your next big idea. Ory Enterprise License
OEL deployment — Ory Keto on OEL means optimized code with premium support for mission-critical production environments, on-prem, self-hosted – wherever else you need it, always up to date. Ory Network
Ory Network deployment — Ory Network includes Ory Keto powered capabilities in an instant-on global identity system. Achieve speed, security, scale, compliance and support with ease.
Integrate Ory Keto with your stack
Amazon SES
Reliably deliver critical identity-related transactional emails
AWS API Gateway
Secure API front door with fine-grained authorization
AWS Infrastructure
Leverage scalable AWS infrastructure for identity management
Discord Social Login
Tap into Discord's large, engaged user base
Integrations
Ready to try Ory Keto?
Integrate Ory Keto with your existing stack in minutes. Quickstarts for Docker and Kubernetes, SDKs for every major language, and reference architectures for RBAC modeling.
policy.ts
import { Namespace, Context } from "@ory/keto-namespace-types"
class User implements Namespace {}
class Document implements Namespace {
related: {
owners: User[]
editors: User[]
viewers: User[]
parents: Folder[]
}
permits = {
view: (ctx: Context): boolean =>
this.related.viewers.includes(ctx.subject) ||
this.related.editors.includes(ctx.subject) ||
this.related.owners.includes(ctx.subject) ||
this.related.parents.traverse((parent) => parent.permits.view(ctx)),
}
}
class Folder implements Namespace {
related: {
owners: User[]
editors: User[]
viewers: User[]
parents: Folder[]
}
}
More on Keto
View all Ory Keto blogs
June 11, 2026
Claude Fable 5 makes vulnerability discovery an API call, guarded by a probabilistic classifier. Why agent authorization must be deterministic, in-loop, and expert-built.
April 16, 2026
Relationship-based permissions are hard to reason about in your head. The Keto Playground renders permission graphs as interactive visualizations so you can see exactly how relationships resolve to ALLOWED or DENIED. It ships with seven bundled examples you can explore and edit in the browser with zero setup.
November 14, 2025
Ory OSS 25.4.0 brings OAuth 2.0 device authorization flow, SMS login, token chain revocation and more — giving developers and IAM builders a solid foundation for IAM.
November 13, 2025
Ory Keto and Ory Oathkeeper v25.4.0 deliver encrypted pagination tokens, better observability, and ecosystem consistency through monorepo migration and shared tooling.
Ory Keto FAQ
Ory Keto is an authorization server that implements Google's Zanzibar research paper. It provides low-latency, relationship-based permission checks at scale. Ory Keto stores relationships between subjects (users, services, devices) and objects (documents, APIs, resources), then resolves permission checks by traversing those relationships. On the Ory Network, it powers the Ory Permissions service. Ory Keto is available as open-source software (Apache 2.0), under the Ory Enterprise License for self-hosted production, and as part of the fully managed Ory Network.
- Global Performance & Reliability - Ory Keto is designed for "split-second decision making," maintaining a 95th-percentile latency of less than 10ms and 99.99% availability. This ensures your application remains responsive and reliable even during massive traffic spikes, so you don’t miss opportunities.
- Operational Efficiency - By decoupling authorization from your application code, your developers can focus on building core product features rather than patching and maintaining homegrown identity infrastructure.
- De-Risking Identity at Scale - Ory Keto reduces the risk of security breaches and inconsistent permission checks. It provides a "unified control plane" that ensures consistent access policies across your entire ecosystem (users, AI agents, services, and IoT).
- Compliance Readiness - The platform is built to be audit-ready for global standards including GDPR, SOC 2, PCI-DSS, and PSD2, helping businesses meet regulatory requirements more easily.
Google Zanzibar is Google's internal authorization system, described in a 2019 research paper. It handles trillions of access control entries and millions of permission checks per second across Google products like Drive, Calendar, and Cloud. Ory Keto is the first and most widely adopted open-source implementation of the Zanzibar model. It adopts Zanzibar's core concepts: relation tuples as the data model, transitive relationship resolution, and the check/expand/list APIs. Ory Keto targets sub-10ms latency at the 95th percentile and scales horizontally.
Ory Keto supports multiple permission models through its relationship-based data structure. Relationship-Based Access Control (ReBAC) is the core model: permissions are encoded as relationships between subjects and objects. Role-Based Access Control (RBAC) is expressed by modeling roles as groups with membership relations. Access Control Lists (ACL) map directly to relation tuples. Attribute-Based Access Control (ABAC) is supported through the Ory Permission Language, which can evaluate conditions on subjects and objects. You can combine these models in a single system.
Ory Keto provides a "deploy-anywhere" authorization service that delivers trillion-scale performance and total flexibility. This allows global enterprises to eliminate vendor lock-in and secure their entire ecosystem of customers, partners, and AI agents. By consolidating identity infrastructure into easily deployable building blocks, Ory reduces total cost of ownership (TCO) and significantly accelerates time-to-market for mission-critical applications.
OPL is a configuration language for defining authorization rules. It uses a subset of TypeScript syntax, so most developers can read and write it without learning a new language. You define namespaces as classes, relations as typed arrays, and permissions as boolean functions that check membership or traverse relationships. OPL is intentionally not Turing-complete, which prevents infinite loops and resource exhaustion during permission evaluation. You can unit-test OPL rules with standard TypeScript tools like Jest.
Ory Keto exposes both REST and gRPC APIs. The Check API determines whether a subject has a specific relation to an object, resolving indirect relationships transitively. The Expand API recursively expands a subject set into a tree, showing who has access and why. The List API queries relationships by partial tuple, for example listing all users who can read a document. A batch check endpoint lets you evaluate multiple permission checks in a single request. All check requests support a configurable max-depth parameter to bound traversal and ensure low latency.
PostgreSQL, MySQL, and CockroachDB are supported for production. SQLite is supported for local development only. Ory Keto scales horizontally: add another container instance without additional configuration. On the Ory Network, the database layer is managed for you.
Ory Keto handles authorization (who can do what). Ory Kratos handles identity (who the user is). Ory Hydra handles delegation (OAuth2/OIDC token issuance). Ory Oathkeeper enforces access policies at the network edge. In a typical setup, Ory Kratos authenticates the user, Ory Oathkeeper validates the session, and Ory Keto decides whether the authenticated user has permission to access the requested resource. On the Ory Network, all four services are pre-integrated.
OPA (Open Policy Agent) and Casbin use a policy-as-code approach: you write rules in a domain-specific language (Rego for OPA) that evaluate against request context at decision time. Ory Keto uses a relationship-based approach: permissions are stored as data (relation tuples), and checks traverse that data graph. This means Ory Keto separates the permission data from the evaluation logic, which makes it easier to update permissions without redeploying policies.The Ory Permission Language uses TypeScript syntax rather than a proprietary language like Rego, so developers can use familiar tools and IDE support. OPL is also intentionally not Turing-complete, reducing the risk of performance issues from complex rules. The Zanzibar model that Ory Keto implements was designed for global scale: trillions of relationships and millions of checks per second.The trade-off is that Ory Keto is purpose-built for authorization, while OPA is a general-purpose policy engine that can also handle non-authorization decisions like admission control or configuration validation.
Yes. Ory Keto's relation tuple model naturally supports hierarchical permissions. You define parent-child relationships between folders and documents, then use the traverse function in OPL to inherit permissions through the hierarchy. For example, a user who has view access to a folder automatically gains view access to all documents in that folder. You can also model organization-level roles, team memberships, and resource-specific overrides. The Ory documentation includes examples of file sharing, document hierarchies, and multi-tenant SaaS permission models.
Ory Keto open source is free under the Apache 2.0 license. You can self-host it at no cost.On the Ory Network, permission checks are billed per API call. Each paid plan includes a monthly usage credit that offsets these costs. The Ory Network free Developer tier is available for testing and proof-of-concept work.For self-hosted production with SLAs, CVE patching, and enterprise features, the Ory Enterprise License is available at custom pricing.
