Speedle
Speedle is an open-source authorization engine written in Go. Applications ask it whether a subject may perform an action on a resource, and it answers allow or deny in milliseconds from centrally managed policies, so authorization logic stays out of application code. It supports role-based (RBAC) and attribute-based (ABAC) access control; deny policies override grants, and anything not granted is denied.
Speedle consists of the Speedle Policy Definition Language (SPDL), the Policy Management Service (PMS, the policy administration point), the Authorization Decision Service (ADS, the policy decision point, which can also be embedded in Go applications), the spctl command-line tool, and integration samples for Docker, Kubernetes and Istio. See the overview for how these map to common authorization terms.
This project is based on the original Speedle open source project, which is hosted at https://github.com/oracle/speedle under UPL.
Who are we
We are the founding members of Speedle project. Now we are not Oracle employees and consequently not contributors of Speedle project on GitHub anymore. But we still stay with Speedle project. We create a new repo under https://github.com/teramoby/speedle-plus and maintain the new project here now.
Documentation
Latest documentations are available at https://engine.speedle.io/docs/.
Get Started
See Getting Started at https://engine.speedle.io/quick-start/.
Try the Playground to write SPDL policies and test authorization decisions directly in your browser, without installing Speedle.
Embed in a Go application
The Authorization Decision Service can run inside a Go process. Start a new Go module:
mkdir speedle-embedded-demo
cd speedle-embedded-demo
go mod init example.com/speedle-embedded-demo
If you already have a Go module, use its directory instead. Save the policies as policies.spdl:
[service.library]
[policy]
grant role librarian read,update book
[rolepolicy]
grant user alice librarian
Save the following program as main.go:
package main
import (
"fmt"
"github.com/teramoby/speedle-plus/api/ads"
"github.com/teramoby/speedle-plus/pkg/eval"
_ "github.com/teramoby/speedle-plus/pkg/store/file" // registers the file store
)
func main() {
evaluator, err := eval.NewFromFile("policies.spdl", false)
if err != nil {
panic(err)
}
for _, user := range []string{"alice", "bob"} {
allowed, reason, err := evaluator.IsAllowed(ads.RequestContext{
Subject: &ads.Subject{Principals: []*ads.Principal{{Type: "user", Name: user}}},
ServiceName: "library",
Resource: "book",
Action: "update",
})
fmt.Println(user, allowed, reason, err)
}
}
Install the dependencies and run the example from the same directory:
go get github.com/teramoby/speedle-plus
go mod tidy
go run .
Output:
alice true GRANT_POLICY_FOUND <nil>
bob false NO_APPLICABLE_POLICIES <nil>
See Embedded mode for details.
Install
With Homebrew on macOS or Linux:
brew tap teramoby/tap
brew trust teramoby/tap
brew install teramoby/tap/spctl
Homebrew does not install or start formulas from a tap outside the official Homebrew organization until that tap is trusted.
The formula is named spctl. On macOS the command is speedle-spctl, so the install does not replace Apple Gatekeeper at /usr/sbin/spctl. On Linux the same program is also available as spctl.
speedle-pms and speedle-ads are installed the same way:
brew install teramoby/tap/speedle-pms
brew install teramoby/tap/speedle-ads
Install the command-line tool and both services together:
brew install teramoby/tap/speedle
The Homebrew page shows how to start the services and run a demo.
With Go 1.26.10 or Go 1.27.3 (or a newer patch on the same release branch):
go install github.com/teramoby/speedle-plus/cmd/...@latest
This installs spctl, speedle-pms and speedle-ads into $(go env GOPATH)/bin, or $GOBIN if it is set.
The same three programs are published as one container image, docker.io/speedle/speedle and ghcr.io/teramoby/speedle, with tags 1.7.0, 1.7 and latest. Run Speedle from the Docker image.
Helm
The chart at deployment/helm/speedle runs PMS and ADS from one image, speedle/speedle. PMS listens on port 6733 and ADS on port 6734. The default policy store is a file on a PersistentVolumeClaim. Set store.type to etcd or mongodb to use those stores. ADS can run more than one replica. The file store keeps a single PMS replica. The chart denies ingress to PMS from other pods until networkPolicy.pms.ingress lists the clients that may administer policy.
From a checkout, with Helm 3:
helm install speedle deployment/helm/speedle
A release that contains the chart also pushes oci://ghcr.io/teramoby/charts/speedle. The chart version matches the image version (vX.Y.Z is chart version X.Y.Z). Helm 3.8 or newer installs an OCI chart:
helm install speedle oci://ghcr.io/teramoby/charts/speedle --version X.Y.Z
Replicas, resources, probes and store flags are in deployment/helm/speedle/values.yaml.
Build from source
Prerequisites
- Go 1.26.10 or Go 1.27.3 (or a newer patch on the same release branch) https://go.dev/doc/install. Speedle supports patched Go 1.26 and Go 1.27 releases. Go sets
GOROOT and GOPATH itself.
Steps
git clone https://github.com/teramoby/speedle-plus.git
cd speedle-plus
go build -o ./bin/ ./cmd/spctl ./cmd/speedle-pms ./cmd/speedle-ads
ls bin
The output is spctl speedle-ads speedle-pms.
Test
Run the unit tests, which need no external services:
go test $(go list ./pkg/... ./cmd/... ./api/... | grep -v -e adsgrpc -e pmsgrpc -e pmsrest)
Get Help
Get Involved
