Topaz is a free OPA sidecar. WardenAuth is a managed platform.
Topaz is Aserto's open-source authorization sidecar — an OPA-based PDP with a directory for user attributes. It's free and runs as a container. But it's infrastructure you operate: write Rego policies, manage the directory, run and monitor the sidecar. WardenAuth is a managed platform — no sidecar, no Rego, no directory to maintain.
Overview
Topaz is the community edition of Aserto's authorization runtime. It gives you OPA-based policy evaluation with a local directory — all open-source and free.
But it's infrastructure. You deploy the container, write and maintain Rego policies, sync user attributes to the directory, and handle monitoring and alerting. For teams building authorization as a feature of their product (not as their product), WardenAuth's managed platform removes the operational burden.
Topaz (Aserto OSS) — Strengths
- Free and open-source (Apache 2.0)
- OPA-based — mature policy engine
- Local directory for user attributes
- Runs as a container — embed anywhere
- gRPC and REST APIs
Topaz (Aserto OSS) — Limitations
- You host and operate the sidecar
- Requires Rego knowledge for policies
- Directory sync required for user attributes
- No management dashboard or UI
- No ReBAC support
- No multi-tenancy, audit trails, or API keys
- No managed cloud offering
Pricing comparison
| Scenario | Topaz (Aserto OSS) | WardenAuth |
|---|---|---|
| Software | Free (open-source, Apache 2.0) | Free (50K checks, managed) |
| Operations | Your infrastructure cost + engineering time | Fully managed |
| Management dashboard | Must build yourself | Included |
Feature comparison
| Feature | Topaz (Aserto OSS) | WardenAuth |
|---|---|---|
| Fine-grained RBAC | Via Rego | |
| ABAC / attribute conditions | ||
| ReBAC / relationships | ||
| Local user directory | ||
| Management dashboard | ||
| Audit trail | ||
| Multi-tenant scopes | ||
| SoD / Approval workflows | ||
| API key management | ||
| Sidecar deployment | ||
| Managed platform | ||
| Flat-rate pricing | Free (self-hosted) |
When each makes sense
Choose Topaz if you want a free, self-hosted OPA-based PDP, are comfortable writing and maintaining Rego policies, need user attributes from a live directory, and have the infrastructure capacity to run and monitor sidecar containers.
Choose WardenAuth if you want managed authorization — no sidecar to deploy, no Rego to write, no directory to sync. If you need RBAC + ReBAC with a visual dashboard and flat-rate pricing.
Topaz is a solid open-source PDP if you want OPA with a directory and are comfortable operating sidecars. For teams that want authorization as a managed service — with RBAC, ReBAC, audit, and a dashboard — WardenAuth removes the operational complexity without locking you into Rego.
See for yourself — no credit card required.