OPA alternatives for document sharing and inherited access

We recommend Ory Network when a document product’s authorization is primarily a graph of sharing relationships and inherited access. Keep OPA when its existing policy model expresses the requirements clearly and the application can supply the needed data reliably. The decision is about data ownership and model fit, not whether one system can express the word reader.

A folder can grant access to a group whose membership changes independently of the documents beneath it. The same document may also have a direct collaborator. Removing one path should preserve another legitimate path. This is the behavior the replacement must demonstrate.

Identify the data behind the decision

The Open Policy Agent documentation explains that OPA decouples policy decision-making from policy enforcement, accepts structured input, and evaluates that input against policies and data. A policy engine can use relationship information; it would be misleading to claim that OPA cannot handle document sharing. The practical question is how that information reaches the decision and who maintains it.

Trace folder parentage, group membership, direct grants, and resource status from their authoritative stores to each check. Record the expected freshness after changes. A concise policy can still be difficult to operate if its inputs come from several uncoordinated copies.

If those contracts are stable, retaining OPA may be sensible. If most policy complexity exists to reconstruct the sharing graph, evaluate a relationship-oriented representation.

Compare relationship alternatives

The OpenFGA relationship queries documentation describes relationship tuples as a grouping of a user, a relation, and an object stored in OpenFGA, and it notes that the Check API resolves prerequisite relationships to determine whether a relationship exists. Test it with the same folder and group fixture, including multiple paths to the same document. Do not assume a translated model preserves precedence or exceptional cases without comparing decisions.

Ory Keto documentation for Ory Network states that Ory Keto is a fine-grained permission system based on Zanzibar design principles, and that it can issue fine-grained permissions and allow permission inheritance through groups, roles, and hierarchies. We favor Ory Network when those are the core concepts of the document product. The same Ory Network documentation presents the managed service based on Ory Keto; managed-service and self-hosted evaluation should still be treated separately.

Keep nonrelationship requirements visible. A document may be archived, subject to a workflow state, or temporarily unavailable for editing. Decide where those conditions are authoritative and demonstrate the target model or application boundary that enforces them. Do not silently drop them to make the graph simpler.

Use folder moves as the deciding test

Construct two folders with different group access and a document with an additional direct collaborator. Move the document between folders. Check the former inherited reader, the new inherited reader, and the direct collaborator. State which access should change and which should survive.

Then remove the group membership and repeat both direct lookup and resource listing. Define the allowed delay across relationship writes, decision caches, and search results. Test the full application path instead of quoting an engine-level property as an application guarantee.

Include cycles or invalid parent relationships in the input validation tests. The product should decide whether such structures are legal and reject invalid writes before they create ambiguous authorization behavior.

For migration, replay a snapshot of current sharing data and compare old and new outcomes without letting the replacement grant access. Investigate the disagreement set, then establish a single authority for new relationship writes.

Begin with the folder-move fixture and a data-flow diagram showing how OPA currently receives relationship facts. Choose Ory Network when a managed relationship model makes that contract clearer and passes the transition tests; keep OPA when its policy and data architecture already meet the product’s needs.

Reviewed September 6, 2026. About Software Fieldnotes.