Cerbos is an open-source authorization engine for RBAC, ABAC, and ReBAC policies. See features, Cerbos Hub pricing, and how it compares to OPA.
Cerbos is an open-source, language-agnostic authorization engine founded in 2021 by Emre Baran, Alex Olivier, and Charith Ellawala, and headquartered in London, United Kingdom. It lets development teams move access-control logic out of application code and into centrally managed policies.
Teams write authorization rules as YAML policies defining who can perform which actions on which resources; the Cerbos Policy Decision Point (PDP) evaluates those policies against each incoming request and returns an allow or deny decision, decoupling permission logic from the rest of the codebase.
The Cerbos PDP is open source under Apache 2.0, written in Go for stateless, horizontally scalable deployment, and evaluates authorization requests with sub-millisecond latency. It supports RBAC, ABAC, ReBAC, and PBAC access-control models out of the box and ships official SDKs for eight languages, including Go, Java, JavaScript, Python, .NET, PHP, Ruby, and Rust. On top of the open-source PDP, Cerbos Hub adds a commercial control plane for policy authoring, testing, versioning, distribution, and audit visibility, and Synapse enriches authorization requests with identity, resource, and relationship data pulled from external systems — including for controlling what AI agents can access.
The Cerbos PDP is free to self-host indefinitely under Apache 2.0. Cerbos Hub, the commercial policy-management layer, has a free Proof of Concept tier (up to 100 monthly active principals), a Development tier starting at $25/month with a three-month free trial, a Production tier starting at $933/month covering the first 5,000 monthly active principals, and a custom-priced Enterprise tier with SSO, self-hosted Hub, and extended audit retention.
The Cerbos Policy Decision Point (PDP) is open source under Apache 2.0 and free to self-host indefinitely. Cerbos Hub, the commercial policy-management layer, has a free tier plus paid Development, Production, and Enterprise tiers.
Cerbos supports role-based (RBAC), attribute-based (ABAC), relationship-based (ReBAC), and general policy-based (PBAC) access control out of the box.
Cerbos Hub starts free for up to 100 monthly active principals, with a Development tier from $25/month, a Production tier from $933/month, and custom Enterprise pricing.
Cerbos provides official SDKs for Go, Java, JavaScript, Python, .NET, PHP, Ruby, and Rust.
Cerbos was founded in 2021 by Emre Baran, Alex Olivier, and Charith Ellawala, and is headquartered in London, United Kingdom.
Synapse is a Cerbos component that fetches identity, resource, and relationship data from external systems to enrich authorization requests, including for governing what AI agents can access.