[bingo_cannon]

How does this compare to Apache Shiro?

[gneray]

I'm not an expert on Shiro, but there are a number of high level differences, e.g.,

- Shiro covers authorization, plus authentication, session mgt, etc. The Carta project is authorization only

- Shiro relies on external data to make authorization decisions. The Carta project stores that data internally

- Shiro is run as part of your app. The Carta project is run as a separate service

    - Related: Shiro is specific to Java.

[supermatt]

Shiro is a framework. This is a service that checks (static) permissions.