Back to catalog
Cerbos
Apache-2.0Cerbos is an open-source authorization engine that decouples access control into Git-managed YAML policies with sub-millisecond local evaluation.
Open-source alternative to — compare it against:
Overview
Cerbos is an open-source authorization engine that decouples access control logic from application code into declarative, version-controlled policies. Operating as a stateless Policy Decision Point sidecar or service, it evaluates contextual access requests against rules written in YAML and Google's Common Expression Language. This architecture lets teams update permissions across distributed services without modifying codebase logic or restarting workloads.
Where Cerbos fits
In most applications, authorization starts as role checks hardcoded into API endpoints or database queries. As systems grow, those checks turn into brittle conditional branches scattered across repositories. General-purpose engines like Open Policy Agent decouple policy across infrastructure, but they require learning specialized domain languages like Rego. Cerbos focuses strictly on application permissions, offering structured schemas and expression syntax that developers and product owners can read and maintain together.
From a workflow perspective, Cerbos treats access policies as standard code artifacts. Rules live in Git alongside test suites, enabling teams to validate changes in CI using the built-in test runner before deployment. The engine loads policies from local disks, Git repositories, object stores, or databases, refreshing in-memory rulesets without service restarts. By compiling policies into optimized internal evaluation trees, Cerbos avoids external network lookups during checks, keeping decisions fast and predictable.
What it does well
- Stateless Policy Decision Point: Deploys as a Kubernetes sidecar or service exposing gRPC and REST endpoints with sub-millisecond evaluation latency.
- Contextual access modeling: Supports role-based, attribute-based, and derived-role models through YAML files and Common Expression Language (CEL) predicates.
- Query plan generation: Produces an abstract syntax tree via
PlanResourcesthat applications map to SQL WHERE clauses to filter large datasets before retrieval. - Built-in test runner: Executes policy unit tests via
cerbos run-testsfor automated verification in continuous integration pipelines. - Multi-source policy loading: Reads policies dynamically from local files, Git repositories, S3 buckets, or relational databases without downtime.