How can I test whether policy based access management fits my application?

You can test whether policy based access management fits your application by taking one real access rule out of your product and writing it as a policy. Pick a rule that already has exceptions in it, because that is where the gap opens between what the documentation says and what the code does. Cerbos Hub lets you write and test that policy against your own rules before anything changes in the application.

Cerbos Included in the KuppingerCole Leadership Compass on Policy Based Access Management

Q: What is the KuppingerCole Leadership Compass on Policy Based Access Management?

The KuppingerCole Leadership Compass on Policy Based Access Management is an analyst report published by KuppingerCole in July 2025 and written by Nitish Deshpande. Cerbos is included as a vendor in it. Policy based access management, the category the report title names, covers products that make access decisions by evaluating a policy against each request.

Q: What is the difference between policy based access management and policy based access control?

The difference between policy based access management and policy based access control is scope. Policy based access control is the model, where an access decision comes from evaluating a policy against the request instead of looking up who holds which role. Policy based access management is the product category name for the platforms that hold, distribute and govern those policies across services.

Q: How should I compare policy based access management vendors?

Compare policy based access management vendors on two things, where the decision runs and what evidence the decision leaves. A decision point that every service calls gives an access rule one definition and one place to change it, and it sits downstream of your identity provider rather than replacing it. On evidence, policies reviewed in Git and tested in CI change under the same process as the rest of your code, and an audit log entry naming the policy that applied is what an auditor asks to see.

Cerbos is included as a vendor in the KuppingerCole Leadership Compass on Policy Based Access Management, published in July 2025. Cerbos is an authorization platform, so this is the market we sit in. If the category is on your list to evaluate, here is what sends teams looking for it and the two questions we would compare vendors on, ours included.

Teams reach this category when one access rule is implemented in several places

Policy based access management is the category name. The model underneath it is policy based access control, where an access decision is made by evaluating a policy against the request instead of looking up who holds which role. If you want the model itself, there is a full definition and the enterprise context on our blog.

What sends teams looking is simpler than the model. A rule like who can approve an expense gets written into three services, by three teams, and over time the three versions stop agreeing.

Compare vendors on where the decision runs and what evidence it leaves

Two questions separate the options in this category more reliably than a feature list does.

The first is where the decision runs. A decision point that every service calls gives the rule one definition and one place to change it, and it sits downstream of your identity provider rather than next to it. The identity provider still says who the caller is. The policy says what that caller can do, on this resource, right now. Externalized authorization is the usual name for that split. It gets harder to avoid once non human identities are in scope. An agent acting for a user needs a decision on every call, and the rule depends on who delegated the authority rather than on a role the agent holds.

The second is what the decision leaves behind. Policies reviewed in Git and tested in CI change under the same process as the rest of your code, and every decision writes an audit log entry naming the policy that applied. That is the evidence an auditor asks to see, and it is the part that is hardest to retrofit once a rule is spread across services.

Writing one of your own rules as a policy is the quickest evaluation you can run

Take one real rule out of your product and write it as a policy. Pick one that already has exceptions in it, because that is where the gap tends to open between what the documentation says and what the code does. Seeing both versions at once is usually enough to tell you whether the rule has one owner or several.

Try Cerbos to write a policy against your own rules and see the decisions it produces, or book a call to talk through your model with our team.

Cerbos is included as a vendor in the KuppingerCole Leadership Compass on Policy Based Access Management (Nitish Deshpande, July 2025). Source, KuppingerCole Analysts.