Oso Authorization for SQLAlchemy

What is Oso Authorization for SQLAlchemy?

Oso Authorization for SQLAlchemy is an open-source integration that brings centralized authorization logic directly into SQLAlchemy database queries. The extension allows developers to define access control rules once and automatically apply them across their application, RAG pipelines, and agentic systems that rely on SQLAlchemy as their ORM. The tool filters database queries based on an application's authorization policies, eliminating the need to duplicate permission logic across multiple layers. It supports local authorization patterns, enabling teams to keep user roles and entitlements in separate services while seamlessly incorporating them into SQLAlchemy queries without requiring data synchronization. A key feature is its compatibility with pgvector, allowing developers to build permissions-aware retrieval-augmented generation (RAG) applications that filter embeddings according to access rules. This makes it particularly useful for organizations building AI-powered search over sensitive or private data. Oso Authorization for SQLAlchemy is designed for teams that need a single source of truth for authorization across distributed systems and modern architectures. It's particularly valuable for applications handling multi-tenant data, regulated industries, or any system where maintaining consistent access control across different data sources is critical. The project is maintained on GitHub and available as open-source software.