Cerbos
Cerbos is an authorization management platform built around an open source policy decision point (PDP). It enforces fine-grained RBAC, ABAC, PBAC, and ReBAC policies for applications, APIs, workloads, and AI agents.
Quick answer
What is Cerbos?
Short answer
Cerbos addresses the authorization layer of identity — not authentication (who are you?) but authorization (what is an already-authenticated identity allowed to do?). The platform has four parts. The open source Cerbos PDP (policy decision point, Apache 2.0) evaluates policies written in YAML, with CEL expressions for conditions, and supports RBAC, ABAC, PBAC, and ReBAC models. Cerbos Hub is the commercial control plane of the same platform, providing policy authoring, testing, versioning, distribution, and audit logs. PEP SDKs in eight languages enforce decisions in application code. Cerbos Synapse (available to Hub customers) enriches authorization requests with identity, resource, and relationship data pulled from IdPs, databases, and APIs at decision time, and translates native protocols so systems like Envoy, Kong, Kafka, Trino, and Kubernetes can be authorized without custom adapters. Applications query the PDP at runtime to evaluate whether a principal can perform an action on a resource, decoupling authorization logic from application code so it is easier to audit, change, and reason about. Verify current pricing at cerbos.dev.
- Best for
- Engineering teams that need fine-grained authorization (RBAC, ABAC, PBAC, or ReBAC) in their applications and want to manage access-control policy separately from application code — particularly in microservices architectures, or where the same policies must consistently govern applications, API gateways, data platforms, and AI agents.
- When to choose
- Choose Cerbos when your application needs fine-grained authorization logic (RBAC, ABAC, PBAC, or ReBAC) that is complex enough to be difficult to maintain in application code, and you want a policy-as-code approach that is auditable and testable — with a managed control plane (Cerbos Hub) available for policy management.
- When not to choose
- Avoid Cerbos if you only need simple role checks (basic RBAC in your application framework is sufficient), or if you expect your authorization logic to remain simple enough that an external policy engine is not worth the integration.
- Related tools & categories
- AuthorizationNon-Human IdentityAI Agent IdentityPermit.ioRun the IAM Stack Finder
Common use cases
- Resource-level authorization: can this user edit this document, in this state, with these attributes?
- RBAC, ABAC, PBAC, and ReBAC in SaaS applications
- Consistent authorization policy enforcement across microservices
- Authorizing infrastructure through Synapse protocol translation: Envoy, Kong, Kafka, Trino, Kubernetes
- Authorization for AI agents and non-human identities, including MCP servers
- Authorization for multi-tenant applications with per-tenant permission variations
- Audit-ready policy evaluation with decision logging
- Policy-as-code workflows with version control and testing
Strengths
- Open source PDP (Apache 2.0) and self-hostable — no vendor dependency for core decision evaluation
- YAML policy language with CEL conditions — approachable for developers and readable by security teams
- RBAC, ABAC, PBAC, and ReBAC covered in one policy model
- Separates authorization policy from application code — easier to audit, test, and change
- PEP SDKs for JavaScript, Go, Python, Java, .NET, Rust, PHP, and Ruby, plus language-agnostic gRPC and REST APIs
- Synapse enriches decisions with IdP, database, and API data and natively authorizes Envoy, Kong, Kafka, Trino, and Kubernetes
- Policy testing capabilities for validating authorization logic
- Multi-tenant support with per-tenant policy variations
Limitations & considerations
- Cerbos handles authorization, not authentication — you still need a separate authentication provider
- Policy design requires understanding of access-control models (RBAC/ABAC/PBAC/ReBAC)
- Self-hosting the PDP requires operational capacity for production deployments
- Synapse, centralized policy management, and audit logs are commercial (Cerbos Hub) features
Pricing model summary
The Cerbos PDP is open source (Apache 2.0) and free to self-host. Cerbos Hub — the commercial control plane for policy authoring, testing, versioning, distribution, and audit logs — and Synapse are paid. Verify current pricing at cerbos.dev.
View vendor pricing page ↗Integrations
Fit
Alternatives & comparisons
Permit.io provides authorization-as-a-service with a low-code policy management interface, RBAC/ABAC/ReBAC policy support, and a managed policy decision layer — enabling teams to ship fine-grained access control without building it from scratch.
Compare Cerbos vs Permit.io →Cerbos and its logo are trademarks of their respective owner. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated.