Fine-Grained Authorization Built on Open-Source Topaz

Aserto was founded in 2020 by Gert Drapers and Omri Gazitt and based in Redmond, Washington. It built authorization tooling for developers who need per-resource access decisions inside applications and APIs, rather than the coarse role checks that ship with most authentication systems. Typical adopters were B2B SaaS vendors moving upmarket, where enterprise buyers ask for granular permissions, complete audit trails, and evidence for ISO 27001 and similar security reviews.

The core is Topaz, an open-source authorizer that pairs an Open Policy Agent policy engine with a directory modeled on Google's Zanzibar design. Policies are authored separately from application code, and the directory holds users, resources, and the relationships between them, so a single deployment can express role-based, attribute-based, and relationship-based models. Authorizers run locally next to the application, returning decisions in roughly a millisecond, with authorization data synchronized from a control plane.

SDKs and middleware cover Node, Go, Python, Java, .NET, and Ruby, with gRPC and REST APIs for everything else, and decision logs feed audit trails and SIEM tools. Aserto announced the shutdown of its hosted control plane on 31 May 2025 and wound down as a commercial entity, so the managed service is no longer available. Topaz remains open source and maintained, and teams continue to adopt it as a self-hosted authorization component.