---
title: "Two approaches to enterprise ABAC"
description: "Axiomatics provides a commercial XACML and ALFA authorization suite. Cerbos combines an Apache 2.0 YAML and CEL policy engine with optional Cerbos Hub and Cerbos Synapse components. Teams with an existing XACML estate should compare policy semantics and operating requirements case by case."
competitor: "Axiomatics"
canonical: "https://www.cerbos.dev/cerbos-vs-axiomatics"
source: "https://www.cerbos.dev/cerbos-vs-axiomatics"
---

# Two approaches to enterprise ABAC

Axiomatics provides a commercial XACML and ALFA authorization suite. Cerbos combines an Apache 2.0 YAML and CEL policy engine with optional Cerbos Hub and Cerbos Synapse components. Teams with an existing XACML estate should compare policy semantics and operating requirements case by case.

## Verdict

**Choose Cerbos when**

- New application-authorization work needs authorization-specific YAML or JSON policies with CEL conditions and a self-service development loop.
- A stateless Apache 2.0 PDP must run close to workloads in sidecar, shared-service, Kubernetes, serverless, or edge topologies.
- The program can migrate XACML semantics incrementally and validate them with dual evaluation.

**Consider Axiomatics when**

- The existing XACML and ALFA estate is stable, governed, and more expensive to translate than to operate.
- XACML semantic continuity, CAQ entitlement analysis, or specialist XACML services are primary requirements.

## Commercial XACML suite, open source YAML and CEL PDP

Axiomatics is a long-established commercial authorization vendor. Its personnel contributed to XACML, and its platform provides PAP, PDP, PEP, and PIP components around XACML and ALFA. Cerbos provides fine-grained ABAC through an Apache 2.0 Go Cerbos PDP using YAML or JSON policies with CEL conditions, plus commercial Cerbos Hub and Cerbos Synapse components for lifecycle management, distribution, audit aggregation, enrichment, and integrations.

The material differences are policy language and semantics, product packaging, governance workflow, licensing, and commercial model. XACML remains an OASIS policy standard. AuthZEN standardizes the interface between enforcement points and decision points independently of the policy language behind the PDP.

**Axiomatics** — Fits enterprise and regulated-sector programs that value XACML and ALFA, centralized policy management, professional services, audit data, and CAQ-based entitlement analysis. Axiomatics has offered patented reverse-query technology since 2011 and remains active in AuthZEN. It is a mature continuity option for an existing XACML estate.

**Cerbos** — Fits teams that want a self-service path to fine-grained authorization. The self-hosted Apache 2.0 Go Cerbos PDP is available as a binary or container and is documented for Kubernetes, sidecar, serverless, and edge deployment. For supported JavaScript environments where embedded evaluation is appropriate, Cerbos Hub's commercial ePDP downloads Cerbos Hub-managed bundles and evaluates them in-process through WebAssembly, without a service call for each decision. Cerbos Hub Enterprise can run on-premise, including in restricted and air-gapped environments, while Cerbos Synapse runs in customer-controlled infrastructure. Policies are YAML or JSON with CEL conditions and can be versioned in Git with validation and tests.

- **Policy language** — Cerbos stores YAML or JSON policies with CEL conditions. Axiomatics supports ALFA as policy as code, compiles it to XACML, and documents Git and CI/CD workflows. OASIS published an ALFA working draft in 2015, but it is not an approved OASIS Standard.
- **Runtime footprint** — Cerbos deploys as a Go binary or container without a separate language VM. Axiomatics documents JAR, Kubernetes, REST and JSON microservice, sidecar, service-mesh, node, and cluster patterns. Benchmark startup, footprint, and throughput in the target topology for both products.
- **Evaluation workflow** — Cerbos provides public tooling to author, test, and run a policy without a mandatory services engagement. Axiomatics routes public evaluation through demo and contact paths and also documents policy as code, DevOps tooling, professional services, and a deployment methodology.

## Selected product dimensions

Reviewed against current Cerbos, neutral standards, and first-party competitor documentation on 24 July 2026.

| Requirement | Cerbos | Axiomatics |
| --- | --- | --- |
| Distributed sidecar enforcement | NATIVE — Runs as a self-hosted binary or container and supports sidecar, Kubernetes, serverless, and edge deployment patterns. | SUPPORTED — Documents JAR and Kubernetes deployment plus REST and JSON microservice, sidecar, service-mesh, node, and cluster integration patterns. Benchmark both products in the target topology. |
| Policy language and authoring | GIT NATIVE — Uses YAML or JSON policies with CEL conditions. Policies can be versioned in Git with compile checks, test suites, and pull request review. | ALFA / XACML — Supports ALFA policy as code or a web editor, with compilation, Git, CI/CD, and automated testing. ALFA has an OASIS working draft but is not a ratified OASIS Standard. |
| Decision time attribute retrieval | VIA SYNAPSE — Keeps the open source Cerbos PDP stateless, with callers passing context. Cerbos Synapse is a commercial platform component, also included within the $0 PoC tier, that supports decision-time enrichment and caching. | BUILT IN — Pulls attributes from LDAP, SQL, and REST sources through mature PIP connectors at decision time. |
| Data filtering and reverse query | BUILT IN — PlanResources returns a datastore-agnostic query plan, with reference adapters for Prisma, Drizzle, Mongoose, Convex, LangChain/ChromaDB, and SQLAlchemy. | BUILT IN — Has offered patented reverse-query technology since 2011. Current CAQ supports entitlement analysis and application data filtering. |
| Decision logging and obligations | BUILT IN — Emits configurable structured decision logs. Rule outputs provide advisory data for the enforcement point on allow and deny paths. | BUILT IN — Provides XACML obligations and advice with a standardized must fulfill contract, plus enterprise audit tooling. |
| Compliance and access review tooling | PARTIAL — Provides decision logs, policy tests, and Git history as technical evidence sources. Auditor acceptance and compliance depend on the wider control environment. | ANALYTICAL — CAQ supports contextual entitlement analysis that can inform access reviews. Verify campaign workflow, attestation, remediation, certification, and IGA integration requirements. |
| AuthZEN compatibility | INTEROP READY — The Cerbos PDP partially implements the AuthZEN Authorization API. Alex Olivier is one of the current AuthZEN Working Group cochairs. | ACTIVE — David Brossard is one of the current Working Group cochairs. Axiomatics and Cerbos have both participated in AuthZEN interoperability demonstrations. |
| Open source and pricing transparency | APACHE 2.0 — The Cerbos PDP is Apache 2.0. Cerbos publishes $0, development, production, and enterprise platform tiers; the $0 PoC tier includes limited Cerbos Hub and Cerbos Synapse usage. | COMMERCIAL — No public list pricing or public self-service free tier was found in the official sources reviewed. Contact Axiomatics for demo, evaluation licensing, services, and pricing. |

### Sources

- [Cerbos deployment](https://docs.cerbos.dev/cerbos/latest/deployment/index.html)
- [Cerbos policies](https://docs.cerbos.dev/cerbos/latest/policies/index.html)
- [OASIS ALFA draft](https://www.oasis-open.org/committees/document.php?document_id=55228&wg_abbrev=xacml)
- [Cerbos Synapse](https://docs.cerbos.dev/synapse/latest/)
- [Cerbos PlanResources adapters](https://docs.cerbos.dev/cerbos/latest/recipes/query-plan-adapters/index.html)
- [Cerbos audit logs](https://docs.cerbos.dev/cerbos/latest/configuration/audit.html)
- [Cerbos rule outputs](https://docs.cerbos.dev/cerbos/latest/policies/outputs.html)
- [Cerbos policy testing](https://docs.cerbos.dev/cerbos/latest/tutorial/04_testing-policies.html)
- [Cerbos AuthZEN API](https://docs.cerbos.dev/cerbos/latest/api/index.html)
- [AuthZEN Working Group](https://openid.net/wg/authzen/)
- [AuthZEN interoperability](https://authzen-interop.net/docs/intro/)
- [Cerbos licence](https://github.com/cerbos/cerbos/blob/main/LICENSE)
- [Cerbos pricing](https://www.cerbos.dev/pricing)

The links beside each row point to Cerbos or neutral standards sources. Competitor documentation informed the review but is not linked from this page.

## Syntax translation is the smallest part of migration

Subject, resource, action, and environment attributes map cleanly in many cases. XACML evaluation semantics require explicit analysis.

Many ALFA or XACML target and condition expressions can be expressed through Cerbos principals, resources, actions, derived roles, and CEL conditions.

Policy sets, rule and policy combining algorithms, Indeterminate results, missing-attribute behavior, obligations, advice, and custom functions do not have a mechanical one-to-one mapping. A translator that only rewrites syntax can preserve the apparent rule while changing the decision.

Build a semantic inventory before translation. Classify each construct as direct, equivalent with restructuring, application-enforced, or unsupported. Use production-derived scenarios and edge cases to compare normalized outcomes from both engines.

## PIP and PDP responsibilities move independently

Cerbos keeps the open source Cerbos PDP stateless. Decision-time retrieval belongs in the caller or in customer-controlled Cerbos Synapse.

Axiomatics packages PAP, PDP, PEP, and PIP concepts around XACML and ALFA. Existing policies may assume that attributes are resolved through configured PIPs during evaluation.

The Cerbos PDP evaluates attributes supplied in the authorization request. Cerbos Synapse can retrieve, transform, and cache context from SQL, identity provider, graph, API, or custom sources before forwarding the decision to the Cerbos PDP.

For supported JavaScript environments, Cerbos Hub's commercial ePDP downloads Cerbos Hub-managed bundles and evaluates them in-process through WebAssembly, with no per-decision service call. It remains distinct from the standalone open source Cerbos PDP.

Cerbos Synapse is commercial and runs in customer-controlled infrastructure. Cerbos Hub provides policy lifecycle, test, signed distribution, and audit aggregation; it does not perform decision-time attribute enrichment.

## XACML continuity remains a valid reason to stay

A mature XACML program contains policy semantics, operating practices, audit evidence, and specialist knowledge.

Axiomatics supports ALFA policy as code, compilation to XACML, Git and CI/CD workflows, centralized management, and professional services. A move to Cerbos should not be justified by assuming that XACML cannot support modern engineering workflows.

Cerbos provides a smaller authorization-specific model and a public self-service development path. Cerbos Hub can govern source-agnostic policy stores and run as an enterprise on-premise deployment, including restricted and air-gapped environments.

Migration is justified only when the target operating model reduces enough policy, runtime, or integration cost to repay semantic translation and revalidation.

## Build a semantic map before changing enforcement

Inventory policy constructs and observable outcomes first. Translate one bounded authorization domain and keep the existing PDP authoritative during comparison.

| XACML or ALFA concept | Cerbos | Notes |
| --- | --- | --- |
| Subject, resource, action, environment | Principal, resource, action, auxiliary data | Record attribute identifiers, types, issuers, defaults, and source systems. |
| Target and condition | Rule scope plus CEL condition | Test absent, null, malformed, and multivalued attributes, not only the expected path. |
| Policy set and combining algorithm | Policy scope, rule ordering, and explicit effect design | No universal mapping exists. Derive the intended decision table and model it explicitly. |
| Obligation or advice | Structured rule output enforced by the application or PEP | Cerbos output is not a XACML must-fulfill contract. The enforcement point must implement and test the behavior. |
| PIP attribute retrieval | Caller-supplied context or Cerbos Synapse enrichment | Map source, cache, timeout, stale-data, and fail-open or fail-closed behavior for each attribute. |

### Dual evaluation for one policy domain

1. **Inventory** — Extract policies, combining algorithms, functions, obligations, attribute sources, and error behavior.
2. **Normalize** — Define a shared request fixture and normalize each engine's response into allow, deny, or evaluation error plus outputs.
3. **Translate** — Model the intended decision table in Cerbos policies and encode representative cases as policy tests.
4. **Replay** — Send production-derived and boundary cases to both PDPs without changing the authoritative enforcement result.
5. **Resolve** — Classify every mismatch as input, semantic, output-enforcement, or engine-error behavior before cutover.

Passing a replay corpus increases confidence but does not prove full semantic equivalence. High-impact rules still require policy-owner review.

## Where Cerbos does not reproduce the XACML suite

Cerbos covers fine-grained application authorization through a different policy and runtime model.

| Capability | Cerbos approach | Guidance |
| --- | --- | --- |
| XACML semantic compatibility | Cerbos uses authorization-specific YAML or JSON policies with CEL conditions rather than XACML or ALFA. | Treat migration as semantic remodeling and dual evaluation, not file conversion. |
| Obligations and advice | Rules can return structured output, but the application or enforcement point must interpret and enforce it. | Map each obligation separately and test failure behavior where fulfillment is mandatory. |
| CAQ entitlement analysis | Cerbos evaluates requests, tests policies, and records decisions when logging is enabled. It does not reproduce CAQ or packaged recertification workflows. | Keep the existing analysis capability or integrate an IGA and reporting workflow where entitlement review is required. |

## The migration path from XACML

Moving off a XACML estate is a project. The products share core ABAC concepts, but migration requires a semantic gap analysis. Many subject, action, resource, and environment conditions can be expressed in Cerbos policies and CEL. Policy hierarchy, combining behavior, obligations and advice, error semantics, and custom functions require separate validation.

One practical approach is an incremental, service-by-service migration. A customer-built harness can send representative requests to both engines and compare normalized results. Build a test corpus from production scenarios and policy edge cases. Passing it increases confidence but does not prove exhaustive equivalence.

Cerbos supports Git-based policy review and testing, stateless PDP deployment, structured decision logs that can support audit evidence, and AuthZEN endpoints. Operational responsibility depends on the selected Cerbos PDP, Cerbos Hub, and Cerbos Synapse deployment model. Contact Cerbos to discuss an assisted policy-mapping and dual-evaluation exercise, subject to scope and data-handling terms.

## Use Cerbos for the next application-authorization boundary

Cerbos is the stronger overall choice for a new or incrementally modernized authorization domain because the Apache 2.0 Cerbos PDP, authorization-specific policies, tests, and cloud-native deployment remove the need to extend the XACML estate. Prove the recommendation with a bounded policy set containing attribute retrieval, a combining rule, and an obligation. Run both PDPs in parallel and review every mismatch before moving enforcement. Keep Axiomatics authoritative only where XACML continuity or CAQ remains a verified requirement.

## Questions you are probably asking

### Axiomatics personnel helped author and edit XACML. Why move off it?

Some teams prefer YAML or JSON with CEL and a smaller self-service PDP footprint. Others value Axiomatics' XACML continuity and broader management suite. AuthZEN defines a PEP-to-PDP API independently of either policy language. Benchmark both products in the target topology, and migrate only when the operating benefit exceeds the migration cost.

### We rely on PIP attribute lookups. Does Cerbos force us to rebuild that?

The model differs. The open source Cerbos PDP is stateless and evaluates context supplied with the request. Cerbos Synapse supports comparable categories of decision-time enrichment, including SQL databases, identity provider APIs, graph stores, other services, and configurable caching. Validate each required connector, transformation, cache, and failure mode.

### Does Cerbos have obligations and advice like XACML?

Cerbos outputs can carry structured rule data for similar application use cases, including field masking, audit logging, and notifications when implemented by the application or enforcement point. They are not XACML obligations or advice and do not provide the same must-fulfill protocol contract. Map and test each obligation use case separately.

### Our program needs access recertification. Can Cerbos do it?

Packaged recertification campaigns are an identity governance function, and neither PDP replaces an IGA tool. Cerbos evaluates each request against the active policy, logs authorization decisions when configured, and runs policy tests against specified scenarios. Axiomatics CAQ can support entitlement analysis. Verify the campaign workflow and evidence requirements with the IGA and audit teams.

## The short version

**Cerbos strengths**

- Delivers fine-grained ABAC through an Apache 2.0 Go Cerbos PDP with documented cloud-native deployment patterns
- Uses YAML or JSON policies with CEL conditions, with Git-based review and testing options
- Supports sidecar, serverless, Kubernetes, and edge deployment patterns
- Offers public self-service tooling for a first working decision without a mandatory services engagement
- Provides decision logs, structured outputs, and test suites that can serve as audit evidence
- Publishes pricing with a free tier

**Weigh with Axiomatics**

- Operating since 2006, with personnel who contributed to XACML
- Documented LDAP, SQL, and HTTP attribute connectors, plus patented reverse-query technology offered since 2011
- CAQ-based entitlement analysis that can support access-review and recertification processes; verify campaign workflow requirements separately
- Professional services and a documented deployment methodology alongside self-managed policy as code and DevOps tooling
- A wholly owned Leonardo subsidiary since 22 December 2025; buyers with ownership or supply-chain requirements should assess the implications
- No public list pricing or public self-service free tier was found; the official site routes evaluation through demo and contact

Contact Cerbos to discuss an assisted policy-mapping and dual-evaluation exercise, subject to scope and data-handling terms.