I actually worked on an implementation based on the Zanzibar paper using OPA at the previous company I worked at. We actually used a Proxy running in front of the microservice to determine whether the request was authorized or not.

We were working in Healthcare and the authorization requirements for healthcare are quite complicated. Every Microservice needed to handle 50 different roles and get the permissions right for each endpoint, so a more centralised approach made a lot of sense to prevent these types of mistakes

Cool to see an open source implementation of the idea. Authorization in general is such a hard topic to get right in a microservice architecture. I'd be happy to take a look at the project and see if I can contribute as well!