The recurring theme of the Zanzibar approach to authorization is that it's prescriptive. The data format, logic language, and API are all tightly specified in order to define authorization in terms of relations between objects and users.

This approach makes a lot of sense at google, which has a famously monolithic culture and the ability to enforce top-down standards. But not so much at other companies.

« Oso has been succeeding while Zanzibar clones have not » -> Oso looks great but don't you think they will end up selling to Google, which is just sad for Open-Source? We've seen this movie before