Cerbos and Ory solve adjacent but distinct problems: Cerbos is a dedicated authorization/policy engine for deciding what an authenticated user or AI agent can…
Best for Cerbos: Teams needing fine-grained, auditable authorization decisions, including AI agent tool-access governance via MCP, separate from their identity provider, with policies deployable on-premise or air-gapped.
Best for Ory: Teams needing customer, B2B, and machine identity (login, SSO, SCIM) with a free Developer tier and a clear path to a $770/year Production plan.
At a Glance
Cerbos
Ory
Primary category
Security
Security
Rating
Not documented
Not documented
Pricing model
Freemium
Freemium
Starting price
Free (PDP open source); Hub from $25/month
Free (Developer tier); Production plan from $70/month
Free plan
Yes
Yes
Free trial
Yes
Not documented
Platforms
Web
Not documented
Team collaboration
Not documented
Not documented
AI features
Not documented
Not documented
Public API
Yes
Yes
Key Differences
Core Function
Cerbos: Cerbos is an authorization/policy-decision engine supporting RBAC, ABAC, ReBAC, and PBAC via a YAML-based policy language.
Ory: Ory is an identity and authentication platform handling customer identity (CIAM), B2B SSO/SCIM, and machine-to-machine login.
Confusing authentication and authorization leads teams to pick the wrong tool for the job, or assume one covers the other.
Pricing Entry Point
Cerbos: Cerbos's open-source core is free with unlimited monthly active principals; paid Development starts at $25/month, and Production starts at $933/month.
Ory: Ory's free Developer tier leads to Production at $770/year and Growth at $9,350/year.
The jump from free to production-grade pricing differs significantly between the two, affecting budget planning.
AI Agent Features
Cerbos: Cerbos offers explicit AI agent guardrails with Model Context Protocol (MCP) integration for governing and revoking agent tool access in seconds.
Ory: Ory documents machine-to-machine authentication for services and agents but doesn't detail MCP-specific tool-access governance.
As AI agents get more autonomy, dedicated tool-access governance becomes a distinct requirement from basic authentication.
Deployment Flexibility
Cerbos: Cerbos can run in Cerbos Hub (cloud), self-hosted, on-premise, or fully air-gapped environments.
Ory: Ory offers self-hosted deployment, an Ory Enterprise License, or the fully managed Ory Network.
Regulated or high-security environments often require air-gapped or on-premise deployment options.
Decision Latency Focus
Cerbos: Cerbos's Policy Decision Points are purpose-built for sub-millisecond authorization decisions at high volume.
Ory: Ory emphasizes stateless horizontal scaling and observability (metrics, trace-level logging) for identity operations rather than policy-decision latency specifically.
Applications making authorization checks on every request need low-latency decisions in the request path.
Feature-by-Feature
Core Function
Feature
Cerbos
Ory
Authorization / permissions engine
Available
Not documented
Authentication / login (SSO, CIAM)
Unavailable
Available
B2B SSO / SCIM
Unavailable
Available
RBAC / ABAC / ReBAC / PBAC policy models
Available
Not documented
AI & Advanced Features
Feature
Cerbos
Ory
AI agent guardrails / MCP integration
Available
Limited
Sub-millisecond decision latency
Available
Not documented
Audit-ready decision logging
Available
Available
Deployment & Pricing
Feature
Cerbos
Ory
Free open-source self-hosted option
Available
Available
Air-gapped deployment
Available
Not documented
Fully managed cloud service
Available
Available
Entry-level paid tier price
Limited
Limited
Pricing Compared
Starting price reflects the lowest paid tier, not the full cost for every team size or usage level.
Cerbos
PDP (Open Source) — Free N/A
Hub - Proof of Concept — $0/month Monthly
Hub - Development — From $25/month Monthly
Hub - Production — From $933/month Monthly
Hub - Enterprise — Custom Annual
Ory
Developer — Free N/A
Production — $70/month + usage Monthly
Growth — $9,350/year + usage Annual
Enterprise — Custom Annual
Pros & Cons
Cerbos
Pros
Open-source PDP is free to self-host indefinitely under Apache 2.0
Supports RBAC, ABAC, ReBAC, and PBAC models rather than a single fixed model
Sub-millisecond decision latency suited to high-throughput applications
Cerbos Hub adds policy testing, versioning, and audit trails without giving up the open-source core
Cons
Production-tier Cerbos Hub pricing starting at $933/month is a significant jump from the Development tier
Requires engineering investment to model application resources and actions as Cerbos policies
Open-core model means some governance and audit features are commercial-only
Relatively young company, founded in 2021, compared to some established authorization and IAM vendors
Ory
Pros
Fully open-source core components under the permissive Apache 2.0 license
Modular architecture lets teams adopt only the pieces they need (identity, OAuth2, permissions, or gateway)
Zanzibar-style permissions engine (Keto) handles complex authorization models that many competitors lack
Both self-hosted and fully managed (Ory Network) deployment options available
API-first, headless design integrates cleanly into custom frontends and mobile apps
Cons
Self-hosting the full stack requires meaningful DevOps and identity domain expertise
Documentation and configuration can be complex for teams new to headless identity infrastructure
Usage-based pricing on Ory Network can grow significantly with active user and permission-check volume
Higher-tier features like multitenancy are gated behind the more expensive Growth and Enterprise plans
Smaller ecosystem and community size compared to more established players like Keycloak
Use Cases
Choose Cerbos: Teams needing fine-grained, auditable authorization decisions, including AI agent tool-access governance via MCP, separate from their identity provider, with policies deployable on-premise or air-gapped.
Choose Ory: Teams needing customer, B2B, and machine identity (login, SSO, SCIM) with a free Developer tier and a clear path to a $770/year Production plan.
Need both: A team building a B2B SaaS product could use Ory for customer login, SSO, and B2B identity management, then use Cerbos as the separate policy engine that decides what each authenticated Ory user or organization is allowed to do inside the application — pairing authentication with authorization is a common real-world architecture.
Cerbos
Fine-Grained SaaS Authorization — Multi-tenant SaaS applications use Cerbos to manage complex, per-resource permission logic outside their application code.
AI Agent Access Control — Teams use Cerbos and Synapse to define and audit exactly what internal systems and data AI agents are permitted to access.
Ory
Consumer app authentication — Product teams use Ory Kratos and Hydra to add login, MFA, and social sign-on to consumer-facing web and mobile apps without building identity infrastructure in-house.
B2B SaaS authorization and multitenancy — B2B SaaS companies use Ory Keto's Zanzibar-style permissions engine to model complex, multi-tenant role and resource permissions.
Zero-trust API access control — Platform and security teams deploy Ory Oathkeeper as an identity-aware proxy in front of internal and external APIs to enforce zero-trust access policies.
Frequently Asked Questions
Do Cerbos and Ory do the same thing?
No. Cerbos handles authorization — deciding what an authenticated user or agent can do. Ory handles authentication and identity — login, SSO, and B2B/M2M identity.
Can Cerbos and Ory be used together?
Yes, in principle: Ory could authenticate users while Cerbos decides what those authenticated users or agents are permitted to do. This isn't a documented official integration, but the two tools address complementary layers of the stack.
Which tool is free to self-host?
Both offer free self-hosted paths. Cerbos's open-source core has unlimited monthly active principals, and Ory's Developer tier is free with 2 development environments.
Does Ory support authorization models like RBAC or ABAC?
Ory's documented features center on identity and authentication (SSO, B2B, M2M) rather than a dedicated multi-model policy engine like Cerbos's RBAC/ABAC/ReBAC/PBAC support.
Which is cheaper to reach a production-grade plan?
Ory's Production plan costs $770/year. Cerbos's Production tier starts much higher, at $933/month.
Does Cerbos support AI agent authorization?
Yes, Cerbos offers explicit AI agent guardrails, including integration with the Model Context Protocol (MCP), to govern and revoke agent tool access.