Who Cerbos is for#
Multi-tenant SaaS teams
Use Cerbos when tenants, roles, and resource-level rules change often and need clear policy ownership.
Skip if:
Your app only has one or two static roles and no compliance pressure.
Platform teams standardizing permissions
Use Cerbos to provide a shared authorization layer across services without forcing every team to invent permission checks.
Skip if:
Each service has unrelated authorization rules and no shared policy governance.
Compliance-heavy engineering teams
Use Cerbos when access decisions need version history, tests, and explainable policy files.
Skip if:
A managed identity platform already covers your authorization needs with acceptable audit output.
The problem it solves#
Authorization logic gets dangerous when every service implements permissions differently. Route handlers, database filters, and business logic accumulate scattered checks that are hard to audit and harder to change. Enterprise customers then ask for new roles, attributes, or compliance evidence, and each policy change becomes an application release risk.
How it solves it#
Policy decision point service
Cerbos runs as a PDP that receives principal, resource, and action data, then returns allow or deny decisions through APIs.
YAML policy-as-code
Access rules live in structured YAML policies that can be stored on disk, in Git, cloud object stores, or supported databases.
RBAC and ABAC support
Cerbos supports role-based rules and attribute-based conditions, allowing teams to model simple roles and more granular contextual access checks.
Deployment flexibility
Kubernetes service, sidecar, systemd service, and AWS Lambda deployment paths let teams place the PDP near the applications it protects.
Strengths and trade-offs#
Strengths
- Centralizes authorization decisionsCerbos gives applications one policy decision interface instead of scattering permission logic throughout codebases.
- Works with existing identity providersCerbos handles authorization, not authentication, so it can sit behind Auth0, Cognito, Okta, custom JWTs, or internal identity systems.
- Good GitOps fitPolicy files can move through Git review and automated tests, which makes access control changes easier to audit.
Trade-offs
- -Adds an authorization service to operateTeams must deploy, monitor, and version the PDP and policy store. Inline checks may be faster for small products with simple permissions.
- -Requires policy modeling disciplineCerbos helps centralize policy, but teams still need to model resources, actions, roles, and attributes carefully to avoid confusing rules.
What it's built on#
- Languages
- Go
- Infrastructure
- Kubernetes
FAQ#
What does Cerbos do?
Cerbos evaluates authorization policies outside application code and returns access decisions for principals, resources, and actions.
Does Cerbos replace authentication?
No. Cerbos handles authorization and can work with identity providers that supply user or service principal data.
Can Cerbos be self-hosted?
Yes. Cerbos supports self-hosted PDP deployment through Kubernetes, sidecar, systemd, and serverless options.
Similar open-source tools#
Warrant
Add RBAC, ABAC, and ReBAC to any app via API and SDK
Oso Cloud
Open source authorization with RBAC, ABAC, and ReBAC for any app
Better Auth
Drop-in TypeScript auth with MFA, SSO, and multi-tenancy support
hysteria
Fast and censorship-resistant proxy solution
Flue Framework
Build powerful, autonomous agents with TypeScript.
Local Deep Research
Your AI research assistant, fully local and encrypted.