---
title: "An authorization platform with service and embedded runtimes, or an engine toolkit"
description: "Cedar is an Apache 2.0 authorization language and engine ecosystem with strong schema validation and formal analysis. Cerbos combines an Apache 2.0 Cerbos service PDP with an optional Cerbos Hub-managed, in-process WebAssembly ePDP and Cerbos Synapse decision-time data. The right choice starts with the product boundary, not policy syntax alone."
competitor: "Cedar"
reviewed: "27 July 2026"
canonical: "https://www.cerbos.dev/cerbos-vs-cedar"
source: "https://www.cerbos.dev/cerbos-vs-cedar"
---

# An authorization platform with service and embedded runtimes, or an engine toolkit

Cedar is an Apache 2.0 authorization language and engine ecosystem with strong schema validation and formal analysis. Cerbos combines an Apache 2.0 Cerbos service PDP with an optional Cerbos Hub-managed, in-process WebAssembly ePDP and Cerbos Synapse decision-time data. The right choice starts with the product boundary, not policy syntax alone.

## Verdict

**Choose Cerbos when**

- Multiple services or languages need one independently deployable authorization API rather than an evaluator embedded into each application.
- Policy build, test, signed distribution, audit collection, list-query planning, or decision-time data would otherwise become internal platform work.
- Deployment control matters across the stack: the Cerbos service PDP and Cerbos Synapse are self-hosted, Cerbos Hub ePDP evaluates in-process, and Cerbos Hub Enterprise is available on-premise for restricted and air-gapped environments.

**Consider Cedar when**

- Symbolic equivalence and permissiveness analysis are firm requirements, or its typed model is the platform standard.
- A native in-process Rust or Go implementation, a Java binding, or an embedded engine without a Cerbos Hub dependency is required. An existing Cedar-based AWS workflow can also be decisive.

## Engine toolkit, production platform

Cedar provides a purpose-built authorization language, embeddable evaluators, schema validation, and unusually strong formal analysis. Its ecosystem includes Rust and Go implementations, Java bindings, WebAssembly, and experimental local-agent foundations. Teams or downstream products still define the production service topology, policy distribution, data providers, and operational workflow.

Cerbos provides those production boundaries directly. The Apache 2.0 Cerbos service PDP exposes REST and gRPC authorization APIs, policy tests, configurable audit logs, and query planning. Optional commercial Cerbos Hub adds policy build, test, distribution, audit workflows, and a Cerbos ePDP that evaluates Cerbos Hub-managed bundles in-process through WebAssembly in JavaScript environments. Cerbos Synapse retrieves, transforms, and caches decision-time data from customer-controlled infrastructure.

Both open source engines use Apache 2.0, and both can express role-, attribute-, and relationship-informed authorization. Cedar is a CNCF Sandbox project and has the stronger formal-analysis story. Cedar provides broader embedded runtime coverage; Cerbos provides both an independently deployable Cerbos service PDP and a Cerbos Hub-managed JavaScript/WebAssembly ePDP within a wider authorization platform.

**Cedar** — Fits teams that want to embed a typed authorization engine, value symbolic analysis of policy sets, or are building around Cedar-compatible and AWS-native authorization workflows. It is especially credible where a native Rust or Go implementation, a Java binding, formal assurance, or operation without a Cerbos Hub dependency outweighs the cost of assembling the surrounding platform.

**Cerbos** — Fits teams that want a language-neutral authorization service with built-in policy tests, audit, list-query planning, and optional lifecycle and data infrastructure. Cerbos Hub can also deliver an in-process WebAssembly Cerbos ePDP for JavaScript environments. The Cerbos service PDP is open source; commercial Cerbos Synapse and enterprise on-premise Cerbos Hub can run in customer-controlled or air-gapped environments.

- **Choose the runtime boundary first** — Cedar embeds through native implementations, bindings, or WebAssembly. Cerbos supports a service, sidecar, or DaemonSet through REST and gRPC, plus a Cerbos Hub-managed ePDP that evaluates in-process through WebAssembly in JavaScript environments.
- **Separate assurance from operations** — Cedar's symbolic analysis can compare policy sets and identify unreachable or overridden policy behavior. Cerbos instead emphasizes executable policy tests, schema checks, audit, rollout, and production operations. These solve different assurance problems.
- **Prototype list filtering early** — Cedar supports partial evaluation and entity slicing concepts. Cerbos PlanResources returns an authorization-specific query plan with reference adapters. In either case, verify the final datastore predicate against real policies and records.

## What application teams actually need

Verified against public documentation on 27 July 2026. The links beside each row point to Cerbos or neutral standards sources; competitor sources informed the research but are not linked here.

| Requirement | Cerbos | Cedar |
| --- | --- | --- |
| Open source authorization engine | APACHE 2.0 — The Cerbos PDP is an Apache 2.0 authorization service with source available for independent operation. | APACHE 2.0 — Cedar's language, core implementations, and principal tooling are Apache 2.0. Genuine parity on licensing. |
| Network-addressable PDP | BUILT IN — Ships a deployable Cerbos PDP with REST and gRPC APIs, health endpoints, SDKs, and documented service, sidecar, and DaemonSet patterns. | IMPLEMENTATION OWNED — Provides embeddable implementations, bindings, and experimental local-agent foundations. The production service contract and topology remain an integration decision. |
| In-process policy evaluation | VIA HUB EPDP — Cerbos Hub ePDP downloads filtered policy bundles and evaluates them in-process through WebAssembly in browsers, Node.js, edge runtimes, and React Native. | NATIVE + WASM — Provides Rust and Go implementations, Java bindings, and WebAssembly. Cedar has broader native embedding; both support in-process WebAssembly. |
| Schemas and policy validation | BUILT IN — Validates policy structure and can enforce JSON schemas for principal and resource attributes. | BUILT IN — Provides typed schemas and validation designed to catch policy and entity-model errors before evaluation. A Cedar strength. |
| Formal policy analysis | TESTS + SCHEMAS — Provides compile checks, schemas, and scenario-based policy tests, but not a symbolic equivalence or permissiveness prover. | SYMBOLIC ANALYSIS — Can compare policy sets for equivalence or permissiveness and find behaviors such as shadowed permits and impossible conditions. Cedar is stronger here. |
| Policy lifecycle and distribution | VIA HUB — Cerbos Hub builds, tests, signs, and distributes policies through managed or enterprise on-premise workflows, including restricted and air-gapped deployments. | ASSEMBLE OR ADOPT — The open source engine evaluates supplied policies. Distribution, approvals, rollout, and fleet management come from the adopter or a downstream Cedar-based product. |
| Decision logging and audit | BUILT IN + HUB — The Cerbos PDP can log decisions to file, local storage, Kafka, or Cerbos Hub. Cerbos Hub adds centralized collection and search. | INTEGRATION OWNED — The engine returns a decision and diagnostics. Experimental local-agent components can emit tracing and OCSF events; durable collection and search depend on the deployment. |
| List filtering and query planning | PLAN + ADAPTERS — PlanResources returns a datastore-agnostic query plan, with reference adapters for six data layers. | ENGINE PRIMITIVES — Partial evaluation and level validation can reduce or bound authorization work. Applications still own safe translation into their datastore query layer. |
| Decision-time data | CALLER OR SYNAPSE — The Cerbos PDP evaluates supplied attributes. Optional Cerbos Synapse retrieves, transforms, and caches context from customer-controlled data sources. | PROVIDER OWNED — The evaluator consumes the request, policies, and relevant entities. The application, agent, or downstream service supplies and refreshes that data. |
| Runtime and language interoperability | APIS + WASM — The Cerbos service PDP serves polyglot applications through stable APIs and official SDKs. Cerbos Hub ePDP adds in-process WebAssembly for JavaScript environments. The Cerbos service PDP partially implements AuthZEN. | EMBEDDABLE — Offers Rust and Go implementations, Java bindings, and WebAssembly. Strong when in-process evaluation is the intended architecture. |

### Sources

- [Cerbos PDP documentation](https://docs.cerbos.dev/cerbos/latest/index.html)
- [Cerbos PDP repository](https://github.com/cerbos/cerbos)
- [Cerbos APIs and SDKs](https://docs.cerbos.dev/cerbos/latest/api/index.html)
- [Cerbos deployment modes](https://docs.cerbos.dev/cerbos/latest/deployment/index.html)
- [Cerbos Hub embedded PDP](https://docs.cerbos.dev/cerbos-hub/deployments-epdp-rules.html)
- [Cerbos schemas](https://docs.cerbos.dev/cerbos/latest/policies/schemas.html)
- [Cerbos policy testing](https://docs.cerbos.dev/cerbos/latest/policies/compile.html)
- [Cerbos Hub](https://docs.cerbos.dev/cerbos-hub/index.html)
- [On-premise Cerbos Hub](https://docs.cerbos.dev/cerbos-hub/on-premises.html)
- [Cerbos audit configuration](https://docs.cerbos.dev/cerbos/latest/configuration/audit.html)
- [Cerbos Hub audit collection](https://docs.cerbos.dev/cerbos-hub/audit-log-collection.html)
- [Cerbos query-plan adapters](https://docs.cerbos.dev/cerbos/latest/recipes/query-plan-adapters/index.html)
- [Cerbos PlanResources API](https://docs.cerbos.dev/cerbos/latest/api/index.html)
- [Cerbos request model](https://docs.cerbos.dev/cerbos/latest/api/index.html)
- [Cerbos Synapse](https://docs.cerbos.dev/synapse/latest/)
- [AuthZEN Working Group](https://openid.net/wg/authzen/)

Cedar refers here to the open source language and engine ecosystem, not Amazon Verified Permissions or another downstream Cedar-based service. Compiled from public documentation in July 2026; verify current capabilities before deciding.

## The decisive difference is the product boundary

Cedar supplies embeddable authorization engines and tooling. Cerbos supplies a deployable PDP plus optional lifecycle and data infrastructure.

A Cedar evaluator receives a request, a policy set, and relevant entity data. Native implementations, bindings, WebAssembly, and experimental local-agent foundations give platform teams several ways to embed or productize that evaluator.

The open source Cerbos PDP is a network-addressable service with REST and gRPC APIs, health endpoints, official SDKs, policy tests, configurable audit, and query planning. Services can share one authorization contract without embedding a language runtime.

Commercial Cerbos Hub also supports an embedded PDP. Its JavaScript client downloads filtered policy bundles from Cerbos Hub and evaluates them in-process through WebAssembly without a per-decision call to a Cerbos service. Cerbos Hub adds managed build, test, signed distribution, and audit workflows, while commercial Cerbos Synapse adds decision-time data and integration extensions. The open source Cerbos service PDP remains independently operable without either product.

## Cedar leads on formal policy analysis

Cedar can reason symbolically about whole policy sets. Cerbos focuses on executable tests, validation, audit, and rollout evidence.

Cedar's analysis tooling can compare two policy sets for equivalence or relative permissiveness and detect cases such as shadowed permits, impossible conditions, or forbids that override expected access. Its symbolic compiler and mechanically checked foundations are meaningful advantages for high-assurance policy work.

Cerbos validates policy structure and attribute schemas, compiles policies before deployment, and runs scenario-based test suites. In production, configurable decision logs and Cerbos Hub audit collection make observed behavior inspectable.

These are complementary assurance layers, not interchangeable features. Choose Cedar when proofs about policy-space behavior are mandatory. Choose Cerbos when consistent deployment, regression tests, decision evidence, and application integration are the larger operational risk.

## Data and list filtering reveal the integration work

Both evaluators need relevant authorization facts. Cerbos packages a query-plan API and offers Cerbos Synapse for decision-time data.

Open source Cedar evaluates the entities and context supplied to it. Level validation and partial evaluation can help bound or defer work, but the adopter still designs entity retrieval, refresh, and datastore-query translation.

The open source Cerbos PDP likewise evaluates attributes supplied in the request. PlanResources returns an authorization-specific, datastore-agnostic query plan, and reference adapters translate supported plans for six data layers.

Optional Cerbos Synapse runs in customer-controlled infrastructure and retrieves, transforms, and caches decision-time data. It changes the platform boundary, not the Cerbos PDP licence: teams that already have reliable context assembly can use the Cerbos PDP alone.

## Map authorization intent before translating syntax

Cedar and Cerbos structure authorization differently. Start from the request contract, entity model, and expected decisions instead of converting policies line by line.

| Cedar concept | Cerbos | Notes |
| --- | --- | --- |
| principal, action, resource, context | principal, actions, and resource; map context to attributes or JWT auxData by meaning | Normalize IDs and attributes at the enforcement point before comparing decisions. Use auxData only for supported JWT-backed facts. |
| permit and forbid policies | EFFECT_ALLOW and EFFECT_DENY rules | Rebuild the decision table explicitly; the combining semantics are not a mechanical text substitution. |
| entity types, attributes, and hierarchy | roles, derived roles, resource attributes, and request context | Choose the Cerbos construct by domain meaning. Keep relationships in supplied data where that is clearer. |
| Cedar schema and validation | principal and resource schemas plus compile checks | Carry required attributes and failure cases into both schema validation and policy tests. |
| partial evaluation and entity slicing | PlanResources query plan | Test generated datastore predicates separately from single-resource checks. |
| application-managed policy set | Cerbos PDP policy store or optional Cerbos Hub workspace | Choose direct self-hosted storage or Cerbos Hub-managed build and distribution based on lifecycle requirements. |

### An owner-or-editor document policy

`document.yaml`

```yaml
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: document
  rules:
    - actions: ["view", "edit"]
      effect: EFFECT_ALLOW
      condition:
        match:
          expr: request.resource.attr.ownerId == request.principal.id
    - actions: ["view", "edit"]
      effect: EFFECT_ALLOW
      roles: ["editor"]
```

Add explicit deny, missing-attribute, hierarchy, and list-filtering cases to the Cerbos test suite. Compare the resulting decisions with the Cedar evaluator before changing the enforcement path.

## Where Cedar remains the stronger fit

Cerbos is the more complete application-authorization platform for many teams. Cedar retains real advantages that should influence the decision.

| Capability | Cerbos approach | Guidance |
| --- | --- | --- |
| Formal policy analysis | Cerbos uses schemas, compile checks, executable policy tests, and production audit rather than a symbolic policy-set prover. | Use Cedar when equivalence, permissiveness, or unreachable-policy analysis is a required assurance control. |
| Native in-process runtimes | Cerbos Hub ePDP evaluates policies in-process through WebAssembly in browsers, Node.js, edge runtimes, and React Native. Current Cerbos guidance recommends the Cerbos service PDP for authoritative server-side routes and middleware. | Prefer Cedar where a native Rust or Go implementation, a Java binding, or an embedded engine without a Cerbos Hub dependency is required. For JavaScript and WebAssembly environments, compare Cedar directly with the Cerbos Hub ePDP. |
| Cedar and AWS ecosystem alignment | Cerbos is cloud and identity provider neutral and exposes its own PDP APIs plus partial AuthZEN compatibility. | Prefer Cedar where compatibility with an existing Cedar policy estate or Cedar-based AWS workflow removes more integration work than Cerbos would. |

## Do not confuse an engine choice with a platform choice

Cedar and the Cerbos service PDP are both purpose-built authorization engines under Apache 2.0. Cedar supplies native embeddable engines, bindings, and analysis primitives. Cerbos supplies an independently deployable Cerbos service PDP and, through commercial Cerbos Hub, a Cerbos ePDP that evaluates filtered policy bundles in-process through WebAssembly in JavaScript environments.

Commercial Cerbos Hub and Cerbos Synapse extend the open source Cerbos service PDP without becoming prerequisites for it. Cerbos Hub adds policy build, test, signed distribution, audit workflows, and Cerbos ePDP bundle delivery. It is hosted by default and available to enterprise customers on-premise for restricted and air-gapped environments. Cerbos Synapse runs in customer-controlled infrastructure to retrieve, transform, and cache decision-time data.

AuthZEN Authorization API 1.0 provides an emerging standard PEP-to-PDP contract. The Cerbos PDP partially implements documented AuthZEN endpoints, and Alex Olivier, Cerbos cofounder and CPO, is one of the current Working Group cochairs. A Cedar deployment can expose AuthZEN, but that service layer is not the open source engine's default product boundary.

## Compare the platform you need to operate, not just the evaluator

Cerbos is the stronger overall default for application authorization because the open source Cerbos service PDP, Cerbos Hub ePDP, query planning, audit, optional Cerbos Hub lifecycle, and optional Cerbos Synapse data layer form a coherent production boundary. Cedar is the stronger choice when formal policy analysis, a native Rust or Go implementation, a Java binding, operation without a Cerbos Hub dependency, or Cedar ecosystem compatibility is decisive. Prove the difference with one policy set that includes single-resource checks, list filtering, policy rollout, audit retrieval, and a decision that needs external context.

## Questions you are probably asking

### Is Cedar only a policy language?

No. Cedar is a language and an engine ecosystem with native implementations, bindings, validation, analysis, tooling, and experimental local-agent foundations. Cerbos takes a different packaging approach: an open source network-addressable Cerbos service PDP plus a commercial Cerbos Hub-managed WebAssembly ePDP for JavaScript environments.

### Does Cerbos offer Cedar's formal verification?

Not today. Cerbos provides schema checks, compile validation, scenario-based policy tests, and production audit. Cedar's symbolic analysis can answer a different class of question about equivalence, permissiveness, and unreachable behavior. If those proofs are mandatory, Cedar has a real advantage.

### Does Cedar support relationship-based authorization?

Yes. Cedar's entity model and hierarchy can express relationship-informed decisions alongside roles and attributes. Cerbos can also use roles, derived roles, resource attributes, and request context. For graph-heavy global authorization, benchmark the data model and lookup path rather than relying on category labels.

### Is Amazon Verified Permissions the same thing as Cedar?

No. Cedar is the open source language and engine ecosystem. Amazon Verified Permissions is a managed AWS service built on Cedar and adds its own APIs, stores, integrations, logging model, limits, and operating boundary. Compare that service separately if it is the actual alternative.

### Can Cerbos run fully inside our environment?

Yes. The open source Cerbos PDP is self-hosted. Cerbos Synapse runs in customer-controlled infrastructure. Cerbos Hub Enterprise is also available on-premise for restricted and air-gapped environments. The components can be adopted independently.

## The short version

**Cerbos strengths**

- Provides an Apache 2.0 Cerbos service PDP for shared, sidecar, and node-local deployment
- Adds a Cerbos Hub-managed ePDP for in-process WebAssembly evaluation in JavaScript environments
- Packages policy tests, configurable audit, and authorization-specific query planning into the runtime
- Adds policy build, signed distribution, and audit workflows through optional Cerbos Hub
- Adds decision-time retrieval, transformation, and caching through self-hosted Cerbos Synapse
- Supports customer-controlled deployment across Cerbos PDP, Cerbos Synapse, and enterprise on-premise or air-gapped Cerbos Hub
- Partially implements AuthZEN Authorization API 1.0; Alex Olivier is a current Working Group cochair

**Weigh with Cedar**

- Cedar has materially stronger symbolic policy analysis and formal-assurance tooling
- A native in-process Rust or Go implementation, or a Java binding, may be the right packaging choice where a Cerbos Hub dependency is not acceptable
- Cedar is a CNCF Sandbox project with substantial AWS and academic investment
- Cedar schemas and validation are a first-class part of its model
- AWS-native or Cedar-compatible ecosystems may make Cedar the lower-friction choice
- An existing, well-operated Cedar platform may not justify migration

Bring one real policy set, one list-filtering path, and your deployment constraints. We will model the same boundary in Cerbos and help you compare decisions, integration code, and operating work.