At a glance
Why OpenFGA
Read AI ran a proprietary, organically built authorization system that hit performance and scalability ceilings as the platform grew. The team evaluated alternatives such as Authzed before choosing OpenFGA, citing:- Zanzibar foundations that aligned with the sharing semantics the product needed.
- Documentation clarity, especially the practical examples and modeling guides.
- The ability to self-host with predictable cost.
- Approachable, responsive maintainers.
Production at scale
The self-hosted OpenFGA service handles peak load of 5,200 requests per second with a 20ms p99 latency and 1.8ms average latency. The data store holds more than 5.3 billion tuples and grows daily. OpenFGA upgrades are folded into a monthly cadence. The OpenFGA release pace is faster than Read AI’s, but upgrades have been smooth with no significant backward-compatibility issues.Outcomes
- Confidence in secure data authorization across the entire product surface.
- Adoption of ReBAC best practices improved internal design decisions.
- Compute and hosting costs dropped versus the prior solution.
- OpenFGA has not been the bottleneck even at peak.
Source
This case study is based on the public CNCF TOC adopter interview with Andrew Powers, Software Engineering Manager at Read AI, available in thecncf/toc repository.