Evaluating Auth0 FGA? Four questions to ask before the Enterprise call

I work at Permit, and a colleague just published our comparison of Auth0 FGA and Permit. We compete with Auth0 FGA, so treat this as a vendor's read. I've tried to pull out the questions that matter whichever one you pick.

Auth0 FGA is Okta's managed fine-grained authorization service. It runs on OpenFGA, the open source CNCF Incubating project modeled on Google's Zanzibar, so the core model is relationships between users and objects. Per its docs, it handles ABAC-style rules through contextual tuples and conditional relationship tuples.

Does the decision have to stay in your network?

Auth0 FGA decisions run in Okta's cloud, and the managed service has no self-hosted decision point. If you need checks inside your VPC, the route is running OpenFGA yourself, which means operating it yourself too. Permit has a hosted Cloud PDP and an Edge PDP container you run next to your service, and the Edge PDP keeps answering from cached policy if our control plane can't be reached.

Is your model mostly relationships?

If your app looks like Google Drive, with folders, shares and nested groups, a Zanzibar-style model fits well, and Auth0 FGA was built for it. If you also need attribute rules, like "only if the refund is under this approver's limit", write a couple of them as conditions in the OpenFGA DSL early and see how they feel. Permit generates Rego or Cedar and lets a relationship and an attribute condition sit in the same check.

Who manages access day to day?

The Auth0 FGA dashboard is for the developers and operators running the service. It recently got per-member roles for that team. If your customers' admins need to manage users, approve access requests or read audit logs inside your product, you'll be building that UI. Permit Elements, our embeddable React components, cover that part for us.

What does production cost?

The Auth0 FGA free trial is for evaluation, and production needs an Enterprise contract through Okta. The subscription page doesn't list prices. Permit's free tier for the classic product covers 1,000 MAU, 20 tenants and 3 environments, and Pro is self-serve and priced on MAU.

If you already use Auth0 for login, keeping authorization in the same ecosystem is a fair reason to choose it, and the post says so. You can also keep Auth0 for authentication and put a different authorization service behind it.

The full comparison, with both tables: https://io.permit.io/auth0-fga-devto

Has anyone here moved from Auth0 FGA to self-hosted OpenFGA, or the other way? I'd like to hear what pushed the decision.