Cerbos
Authorize every identity. Govern every action.
About Cerbos
Cerbos is an authorization management platform that moves access-control logic out of application code into centrally managed YAML policies. Its open-source Policy Decision Point (PDP) runs as a stateless service in your own infrastructure, while Cerbos Hub adds a managed control plane for policy builds, testing, distribution, and unified audit logs. It supports RBAC, ABAC, ReBAC, and PBAC for human users, service accounts, non-human identities, and AI agents.
Pros & Cons
Pros
- Core policy engine is open source (Apache 2.0) and free to self-host with no usage limits
- Stateless PDP runs next to your services, so authorization checks stay fast and data never leaves your infrastructure
- Decouples permissions from application code, so role changes ship as policy updates instead of deploys
- Supports RBAC, ABAC, ReBAC, and PBAC in one engine, including AI agent and MCP use cases
- Built-in policy testing framework and playgrounds catch permission bugs before release
- Reviewers praise the documentation and straightforward SDK integration
Cons
- Pricing is based on monthly active principals, so costs grow with user and service count
- Production Hub plan jumps from $25 to $933/month, a steep step for small teams
- Teams must learn the Cerbos YAML policy language and run PDP infrastructure
- Handles authorization only; you still need a separate identity provider for authentication
- Small public review base on G2 and Capterra compared with larger IAM vendors
Key Features
Open-source Policy Decision Point
Stateless, self-hosted PDP that evaluates authorization requests with a single API call and runs in cloud, on-premise, or air-gapped environments.
YAML policy definition
Roles, permissions, and conditions live in human-readable YAML policies versioned in Git instead of scattered if-statements in code.
RBAC, ABAC, ReBAC and PBAC
Supports role-based, attribute-based, relationship-based, and policy-based access control models out of the box.
Cerbos Hub control plane
Managed service that builds, tests, and distributes policies to all of your PDPs through a managed CI/CD pipeline.
Policy playgrounds and testing
In-browser playgrounds plus an embedded test framework for validating policies before they ship.
Unified audit logs
Records every decision with who, what, when, and which policy, for SOC 2, ISO 27001, HIPAA, and GDPR evidence.
AI agent and MCP authorization
Defines what AI agents and MCP servers can access, supports RAG authorization, and revokes agent access through policy changes.
Cerbos Synapse enrichment
Context layer that enriches authorization requests with data from external sources and integrations.
SDKs and query planning
SDKs for major languages and ORM integrations that turn policies into data filters for listing only the records a user may see.
Multi-tenant policies
Scoped and per-tenant policies for SaaS products where each customer needs its own permission rules.
Pricing
- Self-hosted Cerbos PDP
- YAML-based policy definition
- Audit logs
- CI/CD and IDE tooling
- Git, disk, cloud, or DB policy storage
- Community support
- Up to 100 monthly active principals
- 1 workspace, 2 developers
- 2 playgrounds, 2 simultaneous PDPs
- Up to 5 custom tenants
- 5 policy builds per week
- 1 week of unified audit logs
- Managed CI/CD pipeline
- First 100 monthly active principals included
- 3 workspaces, 5 developers
- Up to 5 playgrounds, 10 simultaneous PDPs
- Up to 20 custom tenants
- 100 policy builds per week
- 3 months of unified audit logs
- Uptime SLA and live chat support
- 3-month free trial
- First 5,000 monthly active principals included
- Unlimited workspaces and developers
- Unlimited playgrounds, PDPs, and tenants
- Unlimited policy builds (fair use)
- 1 year of unified audit logs
- Uptime SLA and live chat support
- SSO support
- Self-hosted Cerbos Hub
- Custom audit log retention
- Enterprise support SLA and phone support
- Quarterly and custom training
Best For
Multi-tenant SaaS permissions
Give each customer tenant its own roles and permission rules without forking application logic.
Fine-grained application access control
Replace hard-coded role checks with central policies that product owners can change without a redeploy.
AI agent and MCP guardrails
Limit which tools, data, and actions an AI agent or MCP server can use on behalf of a user, and revoke access instantly.
RAG authorization
Filter retrieved documents so LLM answers only include data the requesting user is allowed to see.
Compliance audit trails
Produce decision-level logs for SOC 2, ISO 27001, HIPAA, and GDPR audits.
Similar Tools
MeetGeek
AI meeting assistant that records, transcribes, summarizes, and acts on insights from every call
Tuta
Secure email with quantum-resistant encryption
Odoo
Modular open-source ERP for manufacturing & beyond
Vercel
Frontend cloud platform for building, deploying, and scaling modern web applications
Databricks Mosaic AI
Enterprise AI platform for building, deploying, and governing production-quality AI agents
Google Vertex AI
Unified platform for building, deploying, and scaling generative AI and ML models