--- title: Security Benchmarking Authorization Policy Engines:... description: An open-source dynamic evaluation framework called SPEF (Security Policy Evaluation Framework), built by Doyensec with funding from Teleport, benchmarks four... canonical: https://daily.dev/posts/security-benchmarking-authorization-policy-engines-rego-cedar-openfga-teleport-acd-myi2ezixt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD | daily.dev og:description: An open-source dynamic evaluation framework called SPEF (Security Policy Evaluation Framework), built by Doyensec with funding from Teleport, benchmarks four... og:url: https://daily.dev/posts/security-benchmarking-authorization-policy-engines-rego-cedar-openfga-teleport-acd-myi2ezixt og:image: https://api.daily.dev/og/posts/mYI2ezixT.png og:image:alt: Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD **[Teleport](https://daily.dev/sources/teleport)** · 13 min read · 0 upvotes · 0 comments ## Summary An open-source dynamic evaluation framework called SPEF (Security Policy Evaluation Framework), built by Doyensec with funding from Teleport, benchmarks four authorization policy engines - Rego (OPA), Cedar, OpenFGA, and Teleport ACD - across 27 test cases covering security, correctness, and performance. Results show Rego is expressive but error-prone with runtime exceptions and non-determinism; Cedar is safe and deterministic but less flexible; OpenFGA scales well for relationship-based models but struggles with complex logic; Teleport ACD is reliable but defers fine-grained semantics to external systems. The framework runs tests in isolated Docker containers and outputs PASS/FAIL/TIMEOUT/ERROR/NOT APPLICABLE results via an HTML report, intended primarily to track a given engine's evolution across versions rather than as a head-to-head comparison tool. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the main weaknesses found when testing Rego versus Cedar for authorization policies? Rego proved expressive but error-prone, failing multiple tests due to runtime exceptions, non-deterministic behavior, and extensibility risks, while Cedar was safe and deterministic with strong validation and isolation but less flexible for writing complex rules outside typical access control scenarios. These findings came from a 27-test-case benchmark run through Docker-isolated evaluations of each engine. _Comparing authorization engines like Rego and Cedar gets easier when you track detailed benchmarks on daily.dev._ ### What is the Security Policy Evaluation Framework (SPEF)? SPEF is an open-source dynamic evaluation framework created by Doyensec with funding from Teleport that benchmarks authorization policy engines - Rego, Cedar, OpenFGA, and Teleport ACD - for security, correctness, and performance using isolated Docker containers per test case. It runs 27 defined test scenarios and reports PASS, FAIL, TIMEOUT, ERROR, or NOT APPLICABLE outcomes in an HTML report. _Developers building authorization systems can follow tooling like SPEF's evolution on daily.dev._ ### Is OpenFGA suitable for complex authorization logic beyond relationship-based access control? No, OpenFGA is simple and scalable for relationship-based access control (ReBAC) models inspired by Google's Zanzibar system, but it is not well suited for complex logic or validation-heavy use cases. It failed several benchmark tests involving set operations at scale (10,000 and 100,000 sets) compared to Cedar and Teleport ACD, which passed those same tests. _Weighing OpenFGA against other authorization engines is easier with benchmark data on daily.dev._ ## Similar posts on daily.dev - [OpenFGA Becomes a CNCF Incubating Project](https://daily.dev/posts/openfga-becomes-a-cncf-incubating-project-h2sgysikw) · CNCF · 19 upvotes · 0 comments - [What Is Open Policy Agent? Best Practices and Use Cases](https://daily.dev/posts/what-is-open-policy-agent-best-practices-and-use-cases-wqsdtv48j) · Orca Security Blog · 0 upvotes · 0 comments - [Governance That Ships: Embedding Policy as Code Into Your System of Record](https://daily.dev/posts/governance-that-ships-embedding-policy-as-code-into-your-system-of-record-k5du9rdlm) · JFrog · 0 upvotes · 0 comments - [Top 12 Policy as Code \(PaC\) Tools in 2025](https://daily.dev/posts/top-12-policy-as-code-pac-tools-in-2025-fcemrkpds) · Spacelift · 2 upvotes · 0 comments - [Cedar Joins CNCF as a Sandbox Project](https://daily.dev/posts/cedar-joins-cncf-as-a-sandbox-project-appf5vfoi) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/security-benchmarking-authorization-policy-engines-rego-cedar-openfga-teleport-acd-myi2ezixt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD","url":"https://daily.dev/posts/security-benchmarking-authorization-policy-engines-rego-cedar-openfga-teleport-acd-myi2ezixt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-benchmarking-authorization-policy-engines-rego-cedar-openfga-teleport-acd-myi2ezixt"},"datePublished":"2026-08-23T12:23:05.141Z","dateModified":"2026-08-23T12:51:46.676Z","description":"An open-source dynamic evaluation framework called SPEF (Security Policy Evaluation Framework), built by Doyensec with funding from Teleport, benchmarks four...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-benchmarking-authorization-policy-engines-rego-cedar-openfga-teleport-acd-myi2ezixt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authorization","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-benchmarking-authorization-policy-engines-rego-cedar-openfga-teleport-acd-myi2ezixt#faq","mainEntity":[{"@type":"Question","name":"What are the main weaknesses found when testing Rego versus Cedar for authorization policies?","acceptedAnswer":{"@type":"Answer","text":"Rego proved expressive but error-prone, failing multiple tests due to runtime exceptions, non-deterministic behavior, and extensibility risks, while Cedar was safe and deterministic with strong validation and isolation but less flexible for writing complex rules outside typical access control scenarios. These findings came from a 27-test-case benchmark run through Docker-isolated evaluations of each engine. Comparing authorization engines like Rego and Cedar gets easier when you track detailed benchmarks on daily.dev."}},{"@type":"Question","name":"What is the Security Policy Evaluation Framework (SPEF)?","acceptedAnswer":{"@type":"Answer","text":"SPEF is an open-source dynamic evaluation framework created by Doyensec with funding from Teleport that benchmarks authorization policy engines - Rego, Cedar, OpenFGA, and Teleport ACD - for security, correctness, and performance using isolated Docker containers per test case. It runs 27 defined test scenarios and reports PASS, FAIL, TIMEOUT, ERROR, or NOT APPLICABLE outcomes in an HTML report. Developers building authorization systems can follow tooling like SPEF's evolution on daily.dev."}},{"@type":"Question","name":"Is OpenFGA suitable for complex authorization logic beyond relationship-based access control?","acceptedAnswer":{"@type":"Answer","text":"No, OpenFGA is simple and scalable for relationship-based access control (ReBAC) models inspired by Google's Zanzibar system, but it is not well suited for complex logic or validation-heavy use cases. It failed several benchmark tests involving set operations at scale (10,000 and 100,000 sets) compared to Cedar and Teleport ACD, which passed those same tests. Weighing OpenFGA against other authorization engines is easier with benchmark data on daily.dev."}}]} ```