AI · alternatives · 2026
24 alternatives to ZenStack – access control at the ORM layer, built for coding agents
Hi HN, I'm Jiasheng, co-creator of ZenStack. Access control usually ends up scattered across app code instead of living with the data model — and that's riskier when the code is written by an agent, since it's easy to ship a query with a missing or incomplete authorization check. ZenStack enforces policy (RBAC/ABAC/relation-based) directly at the ORM layer, on top of Kysely, so every query gets checked the same way regardless of who wrote it and who is calling it. Postgres RLS is an option too, but it's hard to maintain and scale, and it's Postgres-only — ZenStack's approach is…
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Prices are shown for the 1 we have checked on their own sites, 1 of them free or with a free tier.
- 1
We're excited to announce the launch of ZenStack V1 after a year of refinement. With ZenStack, we introduce ZModel, a domain-specific language (DSL) that simplifies the definition of data and access rules, bringing it closer to the database level. This eliminates the need for extensive, repetitive coding on the application side. We would love to hear your feedback and opinions on it. Thank you!
2023 · github.com · its alternatives →
- 2
Half a year ago, we posed a Show HN about ZenStack V1 as "DSL to define data and access rules closer to the database" Throughout the month, we've attracted quite a few early adopters. Some of them, such as MermaidChart, have successfully launched into production. After talking with them, we realized that many individuals found ZenStack while seeking a cleaner and easier alternative to RLS. As a result, we pivot ourselves to be a “TypeScript toolkit on top of Prisma ORM with a fine-grained Authorization layer, auto-generated type-safe APIs, and frontend hooks”. In V2, besides the more…
2024 · zenstack.dev · its alternatives →
- 3
- 4
A SDK for access control policies: authorization for the microservice and IoT age. Inspired by AWS IAM policies. Written for Go. - ory/ladon
2017 · github.com · its alternatives →
- 5
- 6
Introducing RBAC for AI-Powered Apps on Postgres/Others
2025 · vela-access.app · its alternatives →
- 7
Kastrafree tier, from $19.99/mo▲332Hi HN, Fernando and I built Kastra. Kastra intercepts AI agent tool calls and evaluates them against deterministic policies before they execute. We built this product to control pre- and post-inference workloads. This is aimed at developers using coding agents like Claude Code, Codex, Cursor, and OpenClaw. Kastra pushes an allow, hold, and deny decision before the action runs. You can build these policies in plain English from the web app. The interception engine evaluates the tools, targets, and parameters of every action at sub 1ms at a scale of billions of interceptions per day. We also…
Jul 2026 · kastra.ai · its alternatives →
- 8TB
Hi HN, My team and I are building Tabstack to handle the "web layer" for AI agents. Launch Post: https://tabstack.ai/blog/intro-browsing-infrastructure-ai-ag... Maintaining a complex infrastructure stack for web browsing is one of the biggest bottlenecks in building reliable agents. You start with a simple fetch, but quickly end up managing a complex stack of proxies, handling client-side hydration, and debugging brittle selectors. and writing custom parsing logic for every site. Tabstack is an API that abstracts that infrastructure. You send a URL and an intent; we…
Jan 2026 · its alternatives →
- 9
Discover & Redact PII, PCI, PHI Data from Zendesk
2022 · strac.io · its alternatives →
- 10
We launched ZenStack V2(https://news.ycombinator.com/item?id=40205699) one year ago. It is built on Prisma, adding advanced features like access control, polymorphism, API/Hook generation, etc. But as we added more features, we felt more constrained by our foundation, Prisma(Check out the specific constraints here https://zenstack.dev/blog/next-chapter-1). Therefore, we made a bold decision for ZenStack V3 to reimplement the ORM part from scratch, keeping full compatibility with the Prisma schema and API. As a result, you could get the best of both…
2025 · github.com · its alternatives →
- 11
We’ve been building visual rule engines (clear spreadsheet interfaces -> API endpoints that map incoming data to a large number of potential outcomes), and had the fun idea lately to see what happens when we use our decision table UI with Claude’s PreToolUse hook. The result is a surprisingly useful policy/gating layer– these tables let your team: - Write conditional, exception-friendly policies beyond globs/prefixes (e.g. allow rm -rf only in */node_modules/*, deny / or $HOME, ask if --force or network call; gate kubectl delete / SQL DROP with a clear reason) -…
Jan 2026 · github.com · its alternatives →
- 12
A pure ORM for writing native SQL queries yielding pure business objects - craigmichaelmartin/pure-orm
2021 · github.com · its alternatives →
- 13
- 14
Hi HN, Been hacking on a simple way to run agents entirely inside of a Postgres database, "an agent per row". Things you could build with this: * Your own agent orchestrator * A personal assistant with time travel * (more things I can't think of yet) Not quite there yet but thought I'd share it in its current state.
Feb 2026 · github.com · its alternatives →
- 15
Inspektor is a protocol-aware proxy that is used to enforce access policies👮 - inspektor-dev/inspektor
2022 · github.com · its alternatives →
- 16ZD
Hi everyone, I've made an open-source library for using design by contract (DbC) principles in the Zig programming language. It's called Zig-DbC, and it currently provides the following features: - A simple API to define preconditions, postconditions, and invariants. - Contracts are active in `Debug`, `ReleaseSafe`, and `ReleaseSmall` modes to catch bugs early. - All checks are removed at compile time in `ReleaseFast` mode for zero performance cost. - An optional mode to handle partial state changes in functions that return errors. - Transparent error handling that propagates errors from…
2025 · its alternatives →
- 17
Your agent team, on your machine. Open-source harness for multi-user Claude agents. - yaodub/cast
Jun 2026 · github.com · its alternatives →
- 18
I've been working on Polign and built a small prototype around something I've been thinking about with agent memory. I have built a lightweight/stateless vector db + BM25 search which works really well with typed facts and structured queries. It uses your own S3, or GCS bucket as primary storage, and restarting a node is fairly quick. Demo + writeup: https://polign.com/blog-edge-agent-memory Live search demo: https://demo.polign.com Docs: https://polign.com
Aug 2026 · polign.com · its alternatives →
- 19
Attribute-based access control with a policy UI and policy as code. User, resource, and environment attributes evaluated at decision time.
2022 · permit.io · its alternatives →
- 20
I've been working on a little project recently to solve a problem that I've encountered at every job I've ever had, and I'm eager for some feedback. Having super granular roles & permissions in PostgreSQL is desirable, but quite difficult to maintain (particularly at smaller companies without dedicated security/devops/DBA/whatever who make it their business to maintain it). I've thought for a while that having a declarative way to manage them would be really useful and allow more teams to actually make use of sophisticated security features that PostgreSQL offers in their…
2023 · github.com · its alternatives →
- 21
Custosa▲15Permission and compliance layer for Enterprise AI
Mar 2026 · custosa.com · its alternatives →
- 22
Hey Everyone, Almost year ago we launched Permify an open-source authorization service to build fine-grained and scalable user permissions and access control systems over here(https://news.ycombinator.com/item?id=32096610) My co-founders and I had a enterprise solution agency where we worked with a bunch of fortune 500 companies. Each projects we made we have to re-invent the wheel for access control and authorization. Not having a easy to integrate, scalable and a granular system that can fulfill the requirements of these enterprise companies was a pain in the ass for us. As…
2023 · permify.co · its alternatives →
- 23
Hi HN, I'm Dan Draper, founder of CipherStash. We've spent 5 years building per-value searchable encryption tech. We realized that encryption like this is incredibly powerful but the engineering required is generally not worth the effort. So we built a platform and opensource SDK to take the cry out of cryptography :) CipherStash Stack is: * A searchable encryption SDK for TS and Postgres * Fast, key management with Zerokms (backed by HSM) * A transparent SQL proxy * Auth library and OIDC federation service * Skills for data security Integrations include Prisma Next, Drizzle, Auth0, Clerk…
May 2026 · cipherstash.com · its alternatives →
- 24RA
We've been building things together for a long time. LEGO first, then software. Across every company and project since, one thing kept showing up: database access security was broken. Not always dramatically. Sometimes it was the budget. Sometimes months of convincing. Sometimes just a quiet burden nobody talked about. Support staff with access to every customer's financial data. Engineers who left but somehow still had credentials. A "temporary" password living in Confluence or floating around in Slack DMs. It's 2026 and this is still the default. Solutions cost time and money, usually…
Apr 2026 · rmbug.com · its alternatives →
Also compare
- ZenStack – DSL to define data and access rules closer to the database alternatives
- ZenStack V2 – RLS alternative with declarative Auth rules in Prisma alternatives
- ZenStack alternatives
- A Go Library for Better Access Control alternatives
- Warestack alternatives
- Vela - Access Control for the AI Era alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →