Guide
All articles tagged Guide.
Replacing jump-box privileged access with policy-based authorization at the API gateway
Most privileged access still runs through a jump box. This guide shows how to replace it for API-shaped work with policy-based authorization, grants bounded by time, endpoint, object and quota, enforced at the gateway, with a decision log for every call. Includes a CEL policy example and where the pattern stops.
Authorize outbound model calls before they leave the network
An API key is a binary, so it says nothing about what a caller may ask for, what a request may cost, or whether the file an assistant is about to read should leave the network. Covers authorizing outbound LLM calls at the egress point, and what the control misses.
Human-in-the-loop approval for AI agents: Cerbos partners with iProov
Human-in-the-loop approval for AI agents, with Cerbos and iProov. How policy checks each agent action, when a named approver confirms it with a live genuine human presence check, which actions should need sign-off, and what goes into your audit trail.
Migrating from PlainID to Cerbos
A practical guide to migrating from PlainID to Cerbos. Map PlainID policies, assets and attribute sources to Cerbos, translate a policy with passing tests, replace PDP and Authorizer calls, run both side by side in shadow mode, and cut over one service at a time.
PlainID alternatives
PlainID alternatives for enterprises centralizing authorization. What PlainID does and costs, why teams look elsewhere, which tools on alternatives lists actually replace it, the questions to ask any replacement, and how to switch without a big bang cutover.
Cerbos vs PlainID
Cerbos vs PlainID compared for enterprise authorization programs. How each platform handles policy authoring and review at scale, where decisions run, coverage of gateways, data platforms and AI agents, audit evidence, standards and pricing, with a path for moving from PlainID to Cerbos.
Migrating from Oso to Cerbos
A practical guide to migrating from Oso Cloud or the deprecated oso library to Cerbos. Covers the Polar to Cerbos concept mapping, a worked translation with passing tests, moving facts to request attributes or Cerbos Synapse, list filtering with query plans, and proving parity before cutover.
How we use Cerbos inside Cerbos: Authorizing MCP tool calls
A real internal MCP server authorization setup, from the team that builds Cerbos. See how we give every tool call a named person, separate the person from the workload acting for them, gate warehouse queries and web access in policy, and ship policy changes through Cerbos Hub without redeploying.
AI coding agent authorization should not depend on who runs it
Coding agent permissions set by an approval prompt belong to one developer, on one machine, until someone turns the prompts off. Covers AI coding agent authorization decided centrally instead, what the COAZ draft formalizes, shell escapes a hook never sees, and the missing approval path.
What is AIAM? AI identity and access management explained
AIAM is IAM for AI agents. What it covers, why IAM built for humans breaks for agents, and why identity is the input and authorization is the enforcement.
Cerbos vs Oso
Comparing Cerbos and Oso? This guide covers where authorization data lives, where decisions run, policy language, RBAC, ABAC and relationship handling, list filtering, audit evidence and pricing, with an honest view of when Oso Cloud still fits and when Cerbos is the better choice.
Best IAM solutions for enterprises in 2026
The best IAM solutions for enterprises, broken down by domain. Access management, identity governance, privileged access, machine identity, and authorization, with the notable vendors in each and how to choose, including the fine-grained authorization layer most enterprise identity programs leave hardcoded.
Who owns authorization in a large engineering organization?
A guide to authorization governance across teams. Covers Conway's law and IAM silos, the incident and cloud-cost price of an unowned decision, the layered ownership split the analyst frameworks converge on, and how to start - a layer-by-layer template for deciding who owns what.
Migrating from OpenFGA to Cerbos
How to move fine-grained authorization from OpenFGA to Cerbos, with a concept mapping table, a nested folder model translated into tested policies, Synapse for data at decision time, the code changes for checks and lists, and a shadow mode plan.
OpenFGA alternatives
A practical guide to OpenFGA alternatives, covering who should move now and who can wait, criteria for relationships, attributes, list filtering and audit, the main categories of alternative, and a shadow mode path off OpenFGA without a big bang cutover.
ZITADEL alternatives
ZITADEL alternatives compared by the reason you are leaving, from the AGPL license and free tier limits to operations and tenancy fit. Covers Keycloak, Authentik, Authelia, Ory, and managed options, and how to tell whether permissions, not the identity provider, are the layer that is failing
Cerbos vs OpenFGA
Cerbos vs OpenFGA compared for teams choosing fine-grained authorization. Where relationship data lives and who keeps it in sync, how attribute rules and nested folders are written, listing what a user can see, audit evidence, gateways and AI agents, AuthZEN and pricing for Auth0 FGA.
Migrating from Axiomatics to Cerbos
A practical guide to migrating from Axiomatics to Cerbos. Map XACML and ALFA concepts and every combining algorithm to Cerbos, translate a rule with passing tests, move attribute connectors to Cerbos Synapse, turn obligations into outputs, run both in shadow mode and cut over one service at a time.