Technical decision brief
Cerbos vs Axiomatics
Axiomatics, a Leonardo company since December 2025, provides a commercial XACML and ALFA authorization suite. Cerbos combines an Apache 2.0 YAML and CEL policy engine with optional Cerbos Hub and Cerbos Synapse components. Teams with an existing XACML estate should compare policy semantics and operating requirements case by case.
Prepared by the Cerbos team. Facts last checked on . How we researched this
The decision
Choose Cerbos when
- New application-authorization work needs authorization-specific YAML or JSON policies with CEL conditions and a self-service development loop.
- A stateless Apache 2.0 PDP must run close to workloads in sidecar, shared-service, Kubernetes, serverless, or edge topologies.
- The program can migrate XACML semantics incrementally and validate them with dual evaluation.
Choose Axiomatics when
- The existing XACML and ALFA estate is stable, governed, and more expensive to translate than to operate.
- XACML semantic continuity, CAQ entitlement analysis, or specialist XACML services are primary requirements.
Already on Axiomatics? Switching probably is not worth it when
- The XACML or ALFA estate is stable, and translating it would cost more than operating it.
- Obligations, combining behavior, or CAQ entitlement analysis carry real controls and nothing is planned to replace them.
At a glance
Selected product dimensions
The table describes documented mechanisms. It does not assign winner scores.
| Requirement | Cerbos | Axiomatics |
|---|---|---|
| Distributed sidecar enforcement | Runs as a self-hosted binary or container and supports sidecar, Kubernetes, serverless, and edge deployment patterns. | Documents JAR and Kubernetes deployment, a REST API, and shared-service, sidecar, and Istio or Envoy service-mesh integration patterns. Benchmark both products in the target topology. |
| Evidence for Distributed sidecar enforcement | Cerbos evidenceCerbos deployment (opens in a new tab) | |
| Policy language and authoring | Uses YAML or JSON policies with CEL conditions. Policies can be versioned in Git with compile checks, test suites, and pull request review. | Supports ALFA policy as code or a web editor, with compilation, Git, CI/CD, and automated testing. ALFA has an OASIS working draft but is not a ratified OASIS Standard. |
| Evidence for Policy language and authoring | ||
| Decision time attribute retrieval | Keeps the open source Cerbos PDP stateless, with callers passing context. Cerbos Synapse is a commercial platform component, also included within the $0 PoC tier, that supports decision-time enrichment and caching. | Pulls attributes from LDAP, SQL, and REST sources through mature PIP connectors at decision time. |
| Evidence for Decision time attribute retrieval | Cerbos evidenceCerbos Synapse (opens in a new tab) | |
| Data filtering and reverse query | PlanResources returns a datastore-agnostic query plan, with reference adapters for Prisma, Drizzle, Mongoose, Convex, LangChain/ChromaDB, and SQLAlchemy. | Released reverse-query technology in 2011, since patented. CAQ, available in Access Decision Service, supports entitlement analysis and application data filtering. |
| Evidence for Data filtering and reverse query | Cerbos evidenceCerbos PlanResources adapters (opens in a new tab) | |
| Decision logging and obligations | Emits configurable structured decision logs. Rule outputs provide advisory data for the enforcement point on allow and deny paths. | Provides XACML obligations and advice, which the XACML 3.0 standard requires the enforcement point to fulfill, plus audit logging in Access Decision Service that is off by default. |
| Evidence for Decision logging and obligations | ||
| Compliance and access review tooling | Provides decision logs, policy tests, and Git history as technical evidence sources. Auditor acceptance and compliance depend on the wider control environment. | CAQ supports contextual entitlement analysis that can inform access reviews. Verify campaign workflow, attestation, remediation, certification, and IGA integration requirements. |
| Evidence for Compliance and access review tooling | Cerbos evidenceCerbos policy testing (opens in a new tab) | Axiomatics evidenceAxiomatics blog: Contextual Authorization Query (opens in a new tab) |
| AuthZEN compatibility | The Cerbos PDP partially implements the AuthZEN Authorization API. Alex Olivier is one of the current AuthZEN Working Group cochairs. | David Brossard is one of the current Working Group cochairs. Axiomatics and Cerbos have both participated in AuthZEN interoperability demonstrations. |
| Evidence for AuthZEN compatibility | Axiomatics evidenceOpenID Foundation: AuthZEN interop results (opens in a new tab) | |
| Open source and pricing transparency | The Cerbos PDP is Apache 2.0. Cerbos publishes $0, development, production, and enterprise platform tiers; the $0 PoC tier includes limited Cerbos Hub and Cerbos Synapse usage. | No public list pricing or public self-service free tier was found in the official sources reviewed. Contact Axiomatics for demo, evaluation licensing, services, and pricing. |
| Evidence for Open source and pricing transparency | Axiomatics evidenceAxiomatics: Request a demo (opens in a new tab) |
Deep dive 1
Syntax translation is the smallest part of migration
Subject, resource, action, and environment attributes map cleanly in many cases. XACML evaluation semantics require explicit analysis.
Many ALFA or XACML target and condition expressions can be expressed through Cerbos principals, resources, actions, derived roles, and CEL conditions.
Policy sets, rule and policy combining algorithms, Indeterminate results, missing-attribute behavior, obligations, advice, and custom functions do not have a mechanical one-to-one mapping. A translator that only rewrites syntax can preserve the apparent rule while changing the decision.
Build a semantic inventory before translation. Classify each construct as direct, equivalent with restructuring, application-enforced, or unsupported. Use production-derived scenarios and edge cases to compare normalized outcomes from both engines.
Deep dive 2
PIP and PDP responsibilities move independently
Cerbos keeps the open source Cerbos PDP stateless. Decision-time retrieval belongs in the caller or in customer-controlled Cerbos Synapse.
Axiomatics packages PAP, PDP, PEP, and PIP concepts around XACML and ALFA. Existing policies may assume that attributes are resolved through configured PIPs during evaluation.
The Cerbos PDP evaluates attributes supplied in the authorization request. Cerbos Synapse can retrieve, transform, and cache context from SQL, identity provider, graph, API, or custom sources before forwarding the decision to the Cerbos PDP.
For supported JavaScript environments, Cerbos Hub's commercial ePDP downloads Cerbos Hub-managed bundles and evaluates them in-process through WebAssembly, with no per-decision service call. It remains distinct from the standalone open source Cerbos PDP.
Cerbos Synapse is commercial and runs in customer-controlled infrastructure. Cerbos Hub provides policy lifecycle, test, signed distribution, and audit aggregation; it does not perform decision-time attribute enrichment.
Deep dive 3
XACML continuity remains a valid reason to stay
A mature XACML program contains policy semantics, operating practices, audit evidence, and specialist knowledge.
Axiomatics supports ALFA policy as code, compilation to XACML, Git and CI/CD workflows, centralized management, and professional services. A move to Cerbos should not be justified by assuming that XACML cannot support modern engineering workflows.
Cerbos provides a smaller authorization-specific model and a public self-service development path. Cerbos Hub can govern source-agnostic policy stores and run as an enterprise on-premise deployment, including restricted and air-gapped environments.
Migration is justified only when the target operating model reduces enough policy, runtime, or integration cost to repay semantic translation and revalidation.
Implementation
Build a semantic map before changing enforcement
Inventory policy constructs and observable outcomes first. Translate one bounded authorization domain and keep the existing PDP authoritative during comparison.
| XACML or ALFA concept | Cerbos | Migration or coexistence note |
|---|---|---|
| Subject, resource, action, environment | Principal, resource, action, auxiliary data | Record attribute identifiers, types, issuers, defaults, and source systems. |
| Target and condition | Rule scope plus CEL condition | Test absent, null, malformed, and multivalued attributes, not only the expected path. |
| Policy set and combining algorithm | Policy scope, rule ordering, and explicit effect design | No universal mapping exists. Derive the intended decision table and model it explicitly. |
| Obligation or advice | Structured rule output enforced by the application or PEP | Cerbos output is not a XACML must-fulfill contract. The enforcement point must implement and test the behavior. |
| PIP attribute retrieval | Caller-supplied context or Cerbos Synapse enrichment | Map source, cache, timeout, stale-data, and fail-open or fail-closed behavior for each attribute. |
Dual evaluation for one policy domain
- 1
Inventory
Extract policies, combining algorithms, functions, obligations, attribute sources, and error behavior.
- 2
Normalize
Define a shared request fixture and normalize each engine's response into allow, deny, or evaluation error plus outputs.
- 3
Translate
Model the intended decision table in Cerbos policies and encode representative cases as policy tests.
- 4
Replay
Send production-derived and boundary cases to both PDPs without changing the authoritative enforcement result.
- 5
Resolve
Classify every mismatch as input, semantic, output-enforcement, or engine-error behavior before cutover.
Passing a replay corpus increases confidence but does not prove full semantic equivalence. High-impact rules still require policy-owner review.
Direct boundaries
Where Cerbos does not reproduce the XACML suite
Cerbos covers fine-grained application authorization through a different policy and runtime model.
Axiomatics capability
XACML semantic compatibility
Cerbos approach
Cerbos uses authorization-specific YAML or JSON policies with CEL conditions rather than XACML or ALFA.
Buyer guidance
Treat migration as semantic remodeling and dual evaluation, not file conversion.
Axiomatics capability
Obligations and advice
Cerbos approach
Rules can return structured output, but the application or enforcement point must interpret and enforce it.
Buyer guidance
Map each obligation separately and test failure behavior where fulfillment is mandatory.
Axiomatics capability
CAQ entitlement analysis
Cerbos approach
Cerbos evaluates requests, tests policies, and records decisions when logging is enabled. It does not reproduce CAQ or packaged recertification workflows.
Buyer guidance
Keep the existing analysis capability or integrate an IGA and reporting workflow where entitlement review is required.
Deployment
Deployment control spans the Cerbos platform
The components can be adopted independently and placed according to runtime, governance, and network requirements.
Cerbos PDP
The Apache 2.0 decision engine runs as a shared service, sidecar, DaemonSet, or selected serverless topology.
Explore Cerbos PDPCerbos Hub
Commercial Cerbos Hub is hosted by default and is available to enterprise customers on-premise for restricted and air-gapped environments. The Cerbos ePDP evaluates Cerbos Hub-managed policy bundles in-process through WebAssembly in JavaScript environments.
Explore Cerbos HubCerbos Synapse
The commercial enrichment and integration layer runs in customer-controlled infrastructure in front of an embedded or external PDP.
Explore Cerbos SynapseCerbos capabilities
Follow the implementation details
These pages document the Cerbos mechanisms referenced throughout this comparison.
Research basis and disclosure
Prepared by the Cerbos team. Facts last checked on .
Each claim was checked against the vendor's or project's own public documentation, pricing pages, and release notes, plus neutral standards and foundation sources. Claims are documented rather than tested firsthand unless the text says otherwise. Where a claim says nothing was found as of a date, it describes an absence of public evidence on that date.
Each row in the comparison table links the Cerbos and Axiomatics documentation it relies on. When either product changes, the affected rows are re-checked before this date moves.
Details change, so verify current capabilities with both vendors before you decide.
Alex Olivier, Cerbos cofounder and CPO, is one of the current OpenID Foundation AuthZEN Working Group cochairs. The Cerbos PDP API reference states that it partially implements the AuthZEN Authorization API.
Test the decision
Use Cerbos for the next application-authorization boundary
Cerbos is the stronger overall choice for a new or incrementally modernized authorization domain because the Apache 2.0 Cerbos PDP, authorization-specific policies, tests, and cloud-native deployment remove the need to extend the XACML estate. Prove the recommendation with a bounded policy set containing attribute retrieval, a combining rule, and an obligation. Run both PDPs in parallel and review every mismatch before moving enforcement. Keep Axiomatics authoritative only where XACML continuity or CAQ remains a verified requirement.