Cerbos

L5 — Agent-Aware Governance Policy Engine Free (OSS) / Cerbos Hub managed Apache-2.0 · OSS

OSS authorization policy engine with declarative YAML/JSON policies. Apache-2.0. Sub-millisecond ABAC decisions; sidecar or embedded deployment. Strong fit for fine-grained per-action authorization in microservices and AI agent stacks.

AI Analysis

Cerbos is an OSS authorization policy engine specifically for application authorization — Apache-2.0 license, sub-millisecond decisions, declarative YAML/JSON policies. Cerbos Hub is the managed offering with policy distribution + audit. Pick Cerbos when you need application-level authorization decoupled from your application code: 'can this user perform this action on this resource' answered by a policy engine, not by if-statements scattered across your app. Materially focused on app-authz, distinct from OPA's general-purpose policy language and from infrastructure-policy tools like Kyverno.

Trust Before Intelligence

Cerbos's positioning is the trust insight: by externalizing authorization to a policy engine, you make access decisions auditable, testable, and reviewable independent of application logic. From a Trust Before Intelligence lens, this is the highest leverage point in L5 — every read, write, or action becomes a policy decision recorded in an audit log. Cerbos's per-decision logs (with full context: principal, resource, action, derived roles, effective rule) make compliance audit dramatically easier than scattered authorization logic. The policy-as-code model means you can review authz changes the same way you review application code.

INPACT Score

31/36
I — Instant
6/6

Sub-millisecond policy decisions in-memory. Policies compile to native code paths; no runtime parsing. Performance is among the best in the L5 category.

N — Natural
5/6

Declarative policy YAML + condition expressions (CEL — Common Expression Language). Closer to readable policy than imperative auth code. N=5.

P — Permitted
6/6

Native ABAC — its core purpose. Per-action, per-resource, per-derived-role decisions with full context (principal attributes, resource attributes, environment). The strongest P score in the catalog.

A — Adaptive
5/6

Sidecar deployment, multi-cloud, K8s-native. Embedded mode for ultra-low-latency. Cerbos Hub for managed multi-cluster policy distribution.

C — Contextual
4/6

Decision logs capture full context: principal, resource, action, derived roles, effective rule. Strong C dimension. Cap rule N/A.

T — Transparent
5/6

Decision logs with full context per request. Policy compilation explanation. Why-was-this-decision-made answer is queryable. T=5.

GOALS Score

21/25
G — Governance
5/6

G1=Y (native ABAC), G2=Y (decision logs), G3=N, G4=Y (policy versioning + reproducibility), G5=N, G6=Y (compliance-relevant). 4/6 -> 5 lenient (governance is its purpose).

O — Observability
4/6

O1=Y (Prometheus metrics built-in), O2=Y (decision audit traces enable tracing across services), O3=N (no per-decision cost in self-hosted; Cloud has limited), O4=Y (decision-log alarms catch policy violations fast), O5=N, O6=N. 3/6 -> 4.

A — Availability
4/6

A1=Y (sub-ms decisions), A2=Y (policy updates propagate fast via Cerbos Hub), A3=Y (in-memory policy cache), A4=Y (sidecar redundancy via deployment topology), A5=Y (production deployments documented), A6=Y (parallel decision evaluation). 6/6 -> 4 (capped to maintain consistency with peer scoring).

L — Lexicon
4/6

L1=Y (resource entities have stable identity in policies), L2=N, L3=N, L4=N, L5=Y (action + resource + derived role taxonomy IS policy semantics), L6=N. 2/6 -> 4 lenient (policy lexicon is rich and precise).

S — Solid
4/6

S1=Y (policy decisions deterministic), S2=Y (typed condition variables), S3=Y (decision result reproducible from same policy + context), S4=Y (typed schemas for principal/resource), S5=N (Cerbos doesn't validate input data quality), S6=Y (decision metrics flag policy anomalies). 5/6 -> 4.

AI-Identified Strengths

  • + App-authz focused — the dedicated tool for 'can this user do this action on this resource'
  • + Sub-millisecond decisions via in-memory policy compilation — fast enough for hot-path authorization
  • + Apache-2.0 OSS with strong commercial backing (Cerbos Hub managed offering)
  • + Decision logs with full context — best-in-class auditability for app-authz
  • + Policy-as-code — review, test, version policies the same way you review application code
  • + Schema validation for principals + resources catches policy bugs at compile time
  • + Multi-cloud, K8s-native, sidecar or embedded deployment — flexible operational model

AI-Identified Limitations

  • - App-authz only — for K8s admission control use Kyverno; for general infrastructure policy use OPA
  • - Decision logs require shipping infrastructure (S3, Kafka, OpenSearch) — Cerbos itself doesn't store long-term audit
  • - Policy authoring has a learning curve — CEL conditions + derived roles + schemas requires more upfront design than scattered if-statements
  • - Multi-cluster policy distribution is Cerbos Hub (commercial) — OSS users build their own via GitOps
  • - Smaller ecosystem than OPA — OPA's Rego language has wider adoption across infrastructure tools
  • - Compliance attestations come from Cerbos Hub (cloud) or your substrate; Cerbos OSS has none
  • - Per-decision cost not natively attributed (no per-tenant chargeback for authz)

Industry Fit

Best suited for

Multi-tenant SaaS where per-tenant + per-user authz must be auditable and externally testableHealthcare / financial / regulated workloads where every authz decision must be logged with full contextMicroservices stacks where authz logic risks duplication across services without a central engineComplex authz models (org > team > project > resource) where derived roles + attribute conditions are the natural expressionPolyglot stacks — Cerbos client SDKs span Go, Java, Python, JS, .NET, Ruby, PHP, RustWorkloads on Cerbos Hub for managed policy distribution + SOC 2 compliance

Compliance certifications

Cerbos (OSS) holds no compliance certifications. Cerbos Hub (managed) provides SOC 2 Type II compliance; verify current attestation status. Self-hosted Cerbos inherits substrate compliance. The decision-log architecture supports compliance audit dramatically — every authz decision is recorded with full context, simplifying access-review for SOC 2 / ISO 27001 / HIPAA evidence collection.

Use with caution for

K8s admission control or infrastructure policy — use Kyverno or OPA GatekeeperPure relationship-based authz (Zanzibar-style) at hyperscale — OpenFGA or SpiceDB fit betterTeams unwilling to invest in policy authoring + testing — scattered if-statements may feel easier short-termCompliance-attested workloads needing FedRAMP — verify Cerbos Hub roadmap; use AWS Verified Permissions for FedRAMP authorization-as-a-serviceWorkloads needing per-decision cost attribution for chargeback (not native)

AI-Suggested Alternatives

Open Policy Agent (OPA)

Choose OPA for general-purpose policy (infrastructure, K8s admission, app-authz). Cerbos wins on app-authz ergonomics + decision-log richness; OPA wins on breadth + Rego's universal applicability. Both Apache-2.0; both CNCF-graduated.

View analysis →
OpenFGA

Choose OpenFGA for relationship-based access control (ReBAC, Zanzibar-style — 'user can edit document because they're in this group'). Cerbos wins on attribute-based policies; OpenFGA wins on graph-relationship-based authz at hyperscale.

View analysis →
SpiceDB

Same Zanzibar-style positioning as OpenFGA. Cerbos vs SpiceDB: pick by relationship-based vs attribute-based. They're not competing on the same axis.

View analysis →
AWS Verified Permissions

AWS managed Cedar-based authz. Cerbos wins on portability + OSS posture; AWS wins on managed compliance + AWS-native integration. Cedar (used by AWS Verified Permissions) is conceptually close to Cerbos's policy model but AWS-locked.

View analysis →

Integration in 7-Layer Architecture

Role: L5 application-authz policy engine. Sidecar or embedded deployment evaluating per-request 'can this user do this action on this resource' decisions in sub-millisecond time.

Upstream: Receives decision requests from application services via SDK (Go, Java, Python, JS, .NET, Ruby, PHP, Rust). Receives policy definitions from Cerbos Hub (managed) or GitOps deployment (OSS).

Downstream: Returns allow/deny decisions to caller. Emits decision logs to durable storage (S3, Kafka, OpenSearch). Emits Prometheus metrics for L6 observability.

⚡ Trust Risks

high Authorization logic remains scattered in app code despite Cerbos deployment — defeats the purpose

Mitigation: Conduct an authorization audit; identify all authz checks in app code; migrate to Cerbos policies systematically. Don't deploy Cerbos as 'one more authz layer'; deploy it as 'THE authz layer' with a migration plan.

high Decision logs not shipped to durable storage — audit trail evaporates with Cerbos pod restart

Mitigation: Configure decision log sink to S3, Kafka, or OpenSearch. Validate retention policy. Test decision-log delivery under failure scenarios.

high Policy updates deployed without tests — broken policy denies legitimate access or grants unintended access

Mitigation: Use Cerbos's testing framework (cerbos compile + test). CI gates: policy must pass tests before merge. Test cases cover positive (should allow) and negative (should deny) for each rule.

high Cerbos sidecar single-instance — pod failure denies all access

Mitigation: Deploy at minimum 2 sidecars per pod or 2 replicas of central Cerbos service. Use circuit breaker in client SDK; on Cerbos failure, default-deny + alert (NEVER default-allow).

medium Cerbos used for K8s admission control or infrastructure policy — wrong tool

Mitigation: Use Kyverno or OPA Gatekeeper for K8s admission. Use OPA for general policy beyond app-authz. Cerbos is purpose-built for application authorization; don't stretch it.

Use Case Scenarios

strong Multi-tenant healthcare SaaS where per-patient authz must be auditable for HIPAA

Cerbos policies enforce per-patient + per-role access. Decision logs ship to SIEM. SOC 2 + HIPAA evidence collection becomes 'export decision logs for the audit window'. Policies versioned in Git; access changes reviewable as PRs.

strong Polyglot microservices stack with consistent authz across Go + Python + Node services

Cerbos sidecars deployed per service. SDK calls return decision in <10ms (network roundtrip + sub-ms policy eval). Authz policies live in one place; service code calls Cerbos rather than duplicating if-statements.

weak Single-service monolith where authz is 5 if-statements

Cerbos's overhead isn't justified for trivial authz. The investment pays off at scale (multi-tenant, multi-service, complex roles). For tiny authz models, scattered code is fine — until it isn't.

Stack Impact

L5 Cerbos at L5 provides app-authz primitive. Choice cascades to: how authz logic is structured (centralized vs scattered), how audit trails are produced, how policy changes are reviewed.
L6 Decision logs feed L6 SIEM (Splunk, OpenSearch, Datadog). Per-decision metrics inform compliance reporting + access reviews.
L7 L7 agent runtimes can call Cerbos for per-action authorization. 'Can this agent perform this tool call on this resource on behalf of this user' is a policy decision Cerbos answers.

⚠ Watch For

2-Week POC Checklist

Explore in Interactive Stack Builder →

Visit Cerbos website →

This analysis is AI-generated using the INPACT and GOALS frameworks from "Trust Before Intelligence." Scores and assessments are algorithmic and may not reflect the vendor's complete capabilities. Always validate with your own evaluation.