Launched this week
NodusDB
Zanzibar-style authorization, embedded like SQLite
2 followers
Zanzibar-style authorization, embedded like SQLite
2 followers
NodusDB is an authorization database you import, not a service you call. Write zanzibar-style permissions and check them through nested groups and folders in 14 µs, inside your own python process. Every write also lands in one signed log in your S3 bucket, which gives you replicas, an Iceberg table for SQL audit, time travel and GDPR erasure. Benchmarked in open against SpiceDB and OpenFGA. Free and open source.
Free
Launch Team
AWS Startup AdvisorPersonalized AWS guidance that meets you where you’re already building
Promoted
Hi Everyone, I'm Pragadeesh, and NodusDB is the database I've been building on my own since early October.
Why I built it: almost every app with sharing ends up needing a real permission system. The serious option today is a zanzibar-style service like SpiceDB or OpenFGA, which means every check is a network call, and the history of who could see what lives somewhere else, if it kept at all. I wanted the permission graph inside the app and its history in my own data lake.
What it does:
zanzibar-style schemas, relationship tuples, nested groups and parent folders, checked inside your python process.
Every write goes into one signed, hash-linked log in your S3 bucket. Replicas rebuild from it, it doubles as an Iceberg table you can query with DuckDB or Spark, as_of() shows you any past moment, and erase() removes a person everywhere.
pip install nodusdb on linux, macOS, and Windows. No server to run, no JVM.
The numbers, from an open benchmark on AWS with 570k relationships:
A fully fresh check takes 14 µs at the median, against 4.6 ms for SpiceDB and 3.7 ms for OpenFGA.
At 1,000 checks for a second NodusDB stayed at 12 µs, while both services ran out of CPU
After a revoke, SpiceDB's default mode kept granting access for up to 3.5 s and OpenFGA's cache mode for 10 s. NodusDB never did.
I wrote the benchmark myself, so all of it is public (configs, raw results, CPU traces), and I'd honestly welcome PRs from SpiceDB and OpenFGA teams.
Where it isn't there yet: replicas sync through S3, so they're about 140 ms behind. There's no "what can Alice see" lookup API yet, and its python only for now.
Who its for: python teams that need fine-grained permissions and an audit trail, and would rather not run another service.
What I'd love to hear: if you run authorization in production, what would stop you from using a library instead of a service? And what's missing for your use case?
Its free and open source under Apache-2.0