Technical decision brief
Cerbos vs Axiomatics
Axiomatics provides a commercial XACML and ALFA authorization suite. Cerbos combines an Apache 2.0 YAML and CEL policy engine with optional Cerbos Hub and Cerbos Synapse components. Teams with an existing XACML estate should compare policy semantics and operating requirements case by case.
The decision
Choose Cerbos when
- Default to Cerbos for new application-authorization work when teams want authorization-specific YAML or JSON policies with CEL conditions and a self-service development loop.
- A stateless Apache 2.0 PDP must run close to workloads in sidecar, shared-service, Kubernetes, serverless, or edge topologies.
- The program can migrate XACML semantics incrementally and validate them with dual evaluation.
Choose Axiomatics when
- Keep Axiomatics where the existing XACML and ALFA estate is stable, governed, and more expensive to translate than to operate.
- Choose Axiomatics where XACML semantic continuity, CAQ entitlement analysis, or specialist XACML services are primary requirements.
At a glance
Selected product dimensions
The table describes documented mechanisms. It does not assign winner scores.
| Requirement | Cerbos | Axiomatics |
|---|---|---|
| Distributed sidecar enforcement | Runs as a self-hosted binary or container and supports sidecar, Kubernetes, serverless, and edge deployment patterns. | Documents JAR and Kubernetes deployment plus REST and JSON microservice, sidecar, service-mesh, node, and cluster integration patterns. Benchmark both products in the target topology. |
| Evidence for Distributed sidecar enforcement | ||
| Policy language and authoring | Uses YAML or JSON policies with CEL conditions. Policies can be versioned in Git with compile checks, test suites, and pull request review. | Supports ALFA policy as code or a web editor, with compilation, Git, CI/CD, and automated testing. ALFA has an OASIS working draft but is not a ratified OASIS Standard. |
| Evidence for Policy language and authoring | ||
| Decision time attribute retrieval | Keeps the open source Cerbos PDP stateless, with callers passing context. Cerbos Synapse is a commercial platform component, also included within the $0 PoC tier, that supports decision-time enrichment and caching. | Pulls attributes from LDAP, SQL, and REST sources through mature PIP connectors at decision time. |
| Evidence for Decision time attribute retrieval | ||
| Data filtering and reverse query | PlanResources returns a datastore-agnostic query plan, with reference adapters for Prisma, Drizzle, Mongoose, Convex, LangChain/ChromaDB, and SQLAlchemy. | Has offered patented reverse-query technology since 2011. Current CAQ supports entitlement analysis and application data filtering. |
| Evidence for Data filtering and reverse query | ||
| Decision logging and obligations | Emits configurable structured decision logs. Rule outputs provide advisory data for the enforcement point on allow and deny paths. | Provides XACML obligations and advice with a standardized must fulfill contract, plus enterprise audit tooling. |
| Evidence for Decision logging and obligations | ||
| Compliance and access review tooling | Provides decision logs, policy tests, and Git history as technical evidence sources. Auditor acceptance and compliance depend on the wider control environment. | CAQ supports contextual entitlement analysis that can inform access reviews. Verify campaign workflow, attestation, remediation, certification, and IGA integration requirements. |
| Evidence for Compliance and access review tooling | ||
| AuthZEN compatibility | The Cerbos PDP partially implements the AuthZEN Authorization API. Alex Olivier is one of the current AuthZEN Working Group cochairs. | David Brossard is one of the current Working Group cochairs. Axiomatics and Cerbos have both participated in AuthZEN interoperability demonstrations. |
| Evidence for AuthZEN compatibility | ||
| Open source and pricing transparency | The Cerbos PDP is Apache 2.0. Cerbos publishes $0, development, production, and enterprise platform tiers; the $0 PoC tier includes limited Cerbos Hub and Cerbos Synapse usage. | No public list pricing or public self-service free tier was found in the official sources reviewed. Contact Axiomatics for demo, evaluation licensing, services, and pricing. |
| Evidence for Open source and pricing transparency | ||
Deep dive 1
Syntax translation is the smallest part of migration
Subject, resource, action, and environment attributes map cleanly in many cases. XACML evaluation semantics require explicit analysis.
Many ALFA or XACML target and condition expressions can be expressed through Cerbos principals, resources, actions, derived roles, and CEL conditions.
Policy sets, rule and policy combining algorithms, Indeterminate results, missing-attribute behavior, obligations, advice, and custom functions do not have a mechanical one-to-one mapping. A translator that only rewrites syntax can preserve the apparent rule while changing the decision.
Build a semantic inventory before translation. Classify each construct as direct, equivalent with restructuring, application-enforced, or unsupported. Use production-derived scenarios and edge cases to compare normalized outcomes from both engines.
Deep dive 2
PIP and PDP responsibilities move independently
Cerbos keeps the open source Cerbos PDP stateless. Decision-time retrieval belongs in the caller or in customer-controlled Cerbos Synapse.
Axiomatics packages PAP, PDP, PEP, and PIP concepts around XACML and ALFA. Existing policies may assume that attributes are resolved through configured PIPs during evaluation.
The Cerbos PDP evaluates attributes supplied in the authorization request. Cerbos Synapse can retrieve, transform, and cache context from SQL, identity provider, graph, API, or custom sources before forwarding the decision to the Cerbos PDP.
For supported JavaScript environments, Cerbos Hub's commercial ePDP downloads Cerbos Hub-managed bundles and evaluates them in-process through WebAssembly, with no per-decision service call. It remains distinct from the standalone open source Cerbos PDP.
Cerbos Synapse is commercial and runs in customer-controlled infrastructure. Cerbos Hub provides policy lifecycle, test, signed distribution, and audit aggregation; it does not perform decision-time attribute enrichment.
Deep dive 3
XACML continuity remains a valid reason to stay
A mature XACML program contains policy semantics, operating practices, audit evidence, and specialist knowledge.
Axiomatics supports ALFA policy as code, compilation to XACML, Git and CI/CD workflows, centralized management, and professional services. A move to Cerbos should not be justified by assuming that XACML cannot support modern engineering workflows.
Cerbos provides a smaller authorization-specific model and a public self-service development path. Cerbos Hub can govern source-agnostic policy stores and run as an enterprise on-premise deployment, including restricted and air-gapped environments.
Migration is justified only when the target operating model reduces enough policy, runtime, or integration cost to repay semantic translation and revalidation.
Implementation
Build a semantic map before changing enforcement
Inventory policy constructs and observable outcomes first. Translate one bounded authorization domain and keep the existing PDP authoritative during comparison.
| XACML or ALFA concept | Cerbos | Migration or coexistence note |
|---|---|---|
| Subject, resource, action, environment | Principal, resource, action, auxiliary data | Record attribute identifiers, types, issuers, defaults, and source systems. |
| Target and condition | Rule scope plus CEL condition | Test absent, null, malformed, and multivalued attributes, not only the expected path. |
| Policy set and combining algorithm | Policy scope, rule ordering, and explicit effect design | No universal mapping exists. Derive the intended decision table and model it explicitly. |
| Obligation or advice | Structured rule output enforced by the application or PEP | Cerbos output is not a XACML must-fulfill contract. The enforcement point must implement and test the behavior. |
| PIP attribute retrieval | Caller-supplied context or Cerbos Synapse enrichment | Map source, cache, timeout, stale-data, and fail-open or fail-closed behavior for each attribute. |
Dual evaluation for one policy domain
- 1
Inventory
Extract policies, combining algorithms, functions, obligations, attribute sources, and error behavior.
- 2
Normalize
Define a shared request fixture and normalize each engine's response into allow, deny, or evaluation error plus outputs.
- 3
Translate
Model the intended decision table in Cerbos policies and encode representative cases as policy tests.
- 4
Replay
Send production-derived and boundary cases to both PDPs without changing the authoritative enforcement result.
- 5
Resolve
Classify every mismatch as input, semantic, output-enforcement, or engine-error behavior before cutover.
Passing a replay corpus increases confidence but does not prove full semantic equivalence. High-impact rules still require policy-owner review.
Deployment
Deployment control spans the Cerbos platform
The components can be adopted independently and placed according to runtime, governance, and network requirements.
Cerbos PDP
The Apache 2.0 decision engine runs as a shared service, sidecar, DaemonSet, or selected serverless topology.
Explore Cerbos PDPCerbos Hub
Commercial Cerbos Hub is hosted by default and is available to enterprise customers on-premise for restricted and air-gapped environments. The Cerbos ePDP evaluates Cerbos Hub-managed policy bundles in-process through WebAssembly in JavaScript environments.
Explore Cerbos HubCerbos Synapse
The commercial enrichment and integration layer runs in customer-controlled infrastructure in front of an embedded or external PDP.
Explore Cerbos SynapseCerbos capabilities
Follow the implementation details
These pages document the Cerbos mechanisms referenced throughout this comparison.
Research basis and disclosure
Claims were reviewed against public product documentation, official project material, and standards sources on 24 July 2026.
The links beside each row point to Cerbos or neutral standards sources. Competitor documentation informed the review but is not linked from this page.
Competitor documentation informed this comparison but is not linked from this page. Cerbos documentation and neutral standards or foundation sources were checked separately.
Alex Olivier, Cerbos cofounder and CPO, is one of the current OpenID Foundation AuthZEN Working Group cochairs. The Cerbos PDP API reference states that it partially implements the AuthZEN Authorization API.
Test the decision
Use Cerbos for the next application-authorization boundary
Cerbos is the stronger overall choice for a new or incrementally modernized authorization domain because the Apache 2.0 Cerbos PDP, authorization-specific policies, tests, and cloud-native deployment remove the need to extend the XACML estate. Prove the recommendation with a bounded policy set containing attribute retrieval, a combining rule, and an obligation. Run both PDPs in parallel and review every mismatch before moving enforcement. Keep Axiomatics authoritative only where XACML continuity or CAQ remains a verified requirement.