Short answer: AuthZEN is an API standard. XACML/ALFA, Rego, Cedar and OpenFGA models are mainly policy languages or engines. They are complementary: any of these engines can sit behind an AuthZEN endpoint, so applications integrate once and the policy technology stays swappable.
Comparison at a glance
| What it standardizes | Steward | Model | Relationship to AuthZEN | |
|---|---|---|---|---|
| OpenID AuthZEN | The PEP↔PDP API (JSON over HTTPS), batch, search, discovery | OpenID Foundation | Any (language-neutral) | n/a |
| XACML / ALFA | Policy language, architecture (PEP/PDP/PIP/PAP) and request/response format | OASIS (XACML); ALFA by Axiomatics | ABAC / PBAC | XACML defined the architecture AuthZEN builds on. ALFA/XACML PDPs can expose AuthZEN. |
| OPA / Rego | A general-purpose policy engine and language with its own REST API | CNCF project | Policy-as-code | OPA can be wrapped or extended to answer AuthZEN requests. |
| Cedar | Policy language and evaluation semantics | Open source, originated at AWS | ABAC + RBAC | Cedar-based services such as Amazon Verified Permissions can answer AuthZEN requests. |
| OpenFGA | Relationship (Zanzibar-style) authorization engine and modeling language | CNCF project | ReBAC | OpenFGA exposes AuthZEN endpoints. |
AuthZEN vs XACML
XACML (OASIS) standardized the externalized authorization architecture (PEP, PDP, PIP, PAP), a policy language, and a request/response format, later with JSON and REST profiles. AuthZEN keeps the PEP/PDP split but deliberately standardizes only the wire API, with a deliberately small subject/action/resource/context shape, plus batch and search operations modern applications need. If you run an XACML or ALFA PDP, AuthZEN is the developer-friendly front door to it.
AuthZEN vs OPA (Rego)
OPA is a policy engine. Its Data API is OPA-specific. AuthZEN makes the call site vendor-neutral: a gateway or app that speaks AuthZEN can switch between OPA-based, Cedar-based or ALFA-based PDPs without code changes.
AuthZEN vs Cedar
Cedar is a policy language. Cedar's principal/action/resource/context model maps naturally to AuthZEN's subject/action/resource/context, which makes Cedar engines straightforward AuthZEN PDPs.
AuthZEN vs OpenFGA and Zanzibar-style ReBAC
ReBAC engines answer "does user X have relation R to object Y?". That question maps onto an AuthZEN evaluation, and the AuthZEN Search APIs map onto ReBAC list operations such as "list objects".