Technical decision brief
Cerbos vs Permit.io
Both products target application teams. In its standard hosted model, Permit.io pairs a managed control plane with an open source PDP. Cerbos can run a self-hosted Cerbos PDP from hand-authored policy files with no control plane required for decisions, while Cerbos Hub and Cerbos Synapse add commercial management and enrichment capabilities.
Prepared by the Cerbos team. Facts last checked on . How we researched this
The decision
Choose Cerbos when
- The default should be a modular authorization platform: an independently deployable open source PDP, optional Cerbos Hub policy lifecycle, and commercial Cerbos Synapse enrichment.
- The application team wants YAML or JSON policy with CEL rather than generated Rego or Cedar.
- Policy lifecycle management and decision-time data enrichment should remain separate, optional platform concerns.
Choose Permit.io when
- A low code policy editor is the preferred authoring surface for developers and nondeveloper stakeholders.
- Embeddable access request, approval, and user management components are product requirements.
- OPAL-based policy and data distribution matches the operating model the team wants.
Already on Permit.io? Switching probably is not worth it when
- Product features depend on Permit Elements for access requests, approvals, or user management, and nobody is budgeted to rebuild them.
- Nondevelopers author policy in the low code editor today and would not move to YAML or JSON with CEL.
At a glance
What developer teams ask for
The table describes documented mechanisms. It does not assign winner scores.
| Requirement | Cerbos | Permit.io |
|---|---|---|
| Source of truth for policy | Treats hand authored files in your repository as the authoritative artifact, reviewed and tested like any other code. | Supports cloud UI, API, SDK, IaC, direct code, and customer-owned Git workflows. UI changes generate Rego or Cedar. |
| Evidence for Source of truth for policy | ||
| Policy language | Authors policy directly in YAML or JSON with CEL expressions, without requiring users to maintain generated Rego or Cedar. | Generates Rego or Cedar beneath the low code editor and also supports direct custom policy code. |
| Evidence for Policy language | Cerbos evidenceCerbos policy authoring (opens in a new tab) | |
| Self hosting and cloud dependency | The standalone Cerbos PDP needs no control plane for authoring or decisions. It can run air-gapped with local storage and telemetry disabled; enterprise Cerbos Hub also has an on-premise option. | Supports local Edge PDPs with a cloud control plane. The Enterprise plan also offers the complete control plane on-premise as a multiservice platform. |
| Evidence for Self hosting and cloud dependency | ||
| Embeddable end user access UI | No prebuilt UI components. Applications build access request and user management workflows on Cerbos Hub policy stores, updating policies programmatically through the Cerbos Hub API and SDKs for Go, JavaScript, Python, Java, .NET, PHP, and Rust — documented for per-tenant roles and user-defined permissions. | Ships Permit Elements, embeddable components for access requests, approvals, and user management. A genuine differentiator. |
| Evidence for Embeddable end user access UI | Cerbos evidenceCerbos Hub policy stores (opens in a new tab) | |
| Keeping decision data fresh | Licensed Cerbos Synapse supports decision-time enrichment from SQL and extension-defined HTTP, IdP, or graph sources, with in-memory or Redis caching. | Distributes policy and external data to deployed policy agents in real time through Apache 2.0 OPAL. |
| Evidence for Keeping decision data fresh | ||
| List filtering and query planning | Exposes PlanResources plus six documented query-plan adapters for applying filters in the application datastore. | Supports object filtering, OPA partial evaluation, and a Prisma extension. Evaluate policy-model and adapter coverage for your stack. |
| Evidence for List filtering and query planning | Cerbos evidenceCerbos query-plan adapters (opens in a new tab) | |
| AuthZEN compatibility | The Cerbos PDP partially implements the AuthZEN API, and Cerbos Synapse exposes the Cerbos API in front of an embedded or external Cerbos PDP. Alex Olivier, Cerbos cofounder and CPO, is one of the current AuthZEN Working Group cochairs. | Participated successfully alongside Cerbos in the OpenID AuthZEN interoperability testing published in May 2024. |
| Evidence for AuthZEN compatibility | ||
| Open source and pricing transparency | Publishes the Cerbos PDP under Apache 2.0 with public pricing and a free tier. Cerbos Hub and Cerbos Synapse are commercial add-ons. | Publishes the PDP and OPAL under Apache 2.0 and SDKs under Apache 2.0 or MIT, depending on the SDK. The hosted control plane is proprietary. |
| Evidence for Open source and pricing transparency | Cerbos evidenceCerbos pricing (opens in a new tab) |
Deep dive 1
Ownership starts with the source artifact
Both products support code and Git workflows, but their default authoring paths produce different operational ownership.
Permit supports a cloud UI, API, SDK, IaC, direct code, and customer-owned Git. Changes made through its UI generate Rego or Cedar. That model is useful when policy editors must serve a mixed technical and nontechnical audience.
A standalone Cerbos PDP reads policies authored directly in YAML or JSON with CEL. The repository can remain the authoritative artifact, with review and tests following the application's existing delivery workflow.
Cerbos Hub is optional for the decision path. It adds ingestion, validation, testing, signed bundle distribution, fleet visibility, and audit. Cerbos Hub Enterprise can run on-premise in restricted or air-gapped environments.
Deep dive 2
The control plane and the decision path are separate choices
The products can both place a PDP near the application, but the surrounding dependencies differ.
Permit offers managed Cloud PDPs and Edge PDP containers. The Edge PDP normally receives policy and data updates through the configured Permit control plane and OPAL.
The standalone open source Cerbos PDP can evaluate from local or Git-backed policy storage without contacting Cerbos Hub. A sidecar or service deployment keeps the synchronous request inside the application's infrastructure. For supported JavaScript environments, Cerbos Hub's commercial ePDP downloads Cerbos Hub-managed bundles and evaluates them in-process through WebAssembly, with no per-decision service call.
Permit also offers an enterprise on-premise control plane. The decision is therefore not simply cloud versus self-hosted. Compare the number of components, policy distribution path, failure behavior, and which team operates each component.
Deep dive 3
Data distribution and decision-time enrichment solve different problems
OPAL distributes data to policy agents; Cerbos Synapse retrieves context when a decision is evaluated.
OPAL is an Apache 2.0 distribution engine for policy and external data. It fits systems that want policy agents to receive updates before a check is made.
Commercial Cerbos Synapse runs in customer-controlled infrastructure. It can retrieve and transform identity, resource, or relationship context at decision time, with configured caching, before an embedded or external Cerbos PDP evaluates policy.
Neither mechanism removes data-lifecycle design. Teams still need to define authoritative sources, acceptable staleness, cache behavior, and failure handling.
Implementation
Map the operating model before moving policy
A migration can preserve existing application enforcement points while changing authoring, distribution, and context retrieval independently.
| Permit.io concept | Cerbos | Migration or coexistence note |
|---|---|---|
| Policy editor and generated Rego or Cedar | Directly authored YAML or JSON policies with CEL conditions | Translate the effective rules and tests, not the generated source line by line. |
| Cloud PDP or Edge PDP | Self-hosted Cerbos PDP as a sidecar, DaemonSet, or service | Keep the existing PEP and replace its authorization client at one boundary first. |
| Permit control plane and OPAL updates | Local or Git policy storage, or optional Cerbos Hub bundle distribution | Select the policy path independently from the runtime decision topology. |
| Distributed external authorization data | Request attributes supplied by the application or fetched through Cerbos Synapse | Choose per datum whether the caller or customer-controlled Cerbos Synapse owns freshness. |
A local decision path with optional management
- 1
1. Author
Engineers edit Cerbos policy and tests directly in the source repository.
- 2
2. Distribute
The Cerbos PDP reads local or Git-backed policy, or receives a signed bundle from Cerbos Hub.
- 3
3. Check
The application sends principal, action, resource, and current attributes to its local Cerbos PDP.
- 4
4. Enforce
The application applies the allow or deny response without a hosted control-plane call.
Cerbos Hub can manage the lifecycle without becoming a mandatory synchronous dependency. Cerbos Synapse is added only when decision-time enrichment is required.
Direct boundaries
Where Cerbos is not a drop-in substitute
These differences can determine the decision before policy syntax or deployment cost is compared.
Permit.io capability
Embeddable access workflows
Cerbos approach
No prebuilt UI components. Applications build access request and user management workflows on Cerbos Hub policy stores, updating policies programmatically through the Cerbos Hub API and SDKs.
Buyer guidance
Choose Permit Elements when those interfaces are a core product requirement, or plan to build and maintain them separately.
Permit.io capability
Low code authoring for nondevelopers
Cerbos approach
Cerbos policy is directly authored as YAML or JSON with CEL; Cerbos Hub adds lifecycle tooling but does not replace Permit's low code editor.
Buyer guidance
Validate the authoring workflow with the people who will change policy, not only the engineers integrating the Cerbos PDP.
Permit.io capability
Push-based external data distribution
Cerbos approach
The Cerbos PDP evaluates supplied attributes, while Cerbos Synapse retrieves context at decision time. Cerbos does not reproduce OPAL's distribution model.
Buyer guidance
Keep Permit or OPAL where pushed local data replicas are required, or redesign the source and freshness contract before migrating.
Deployment
Deployment control spans the Cerbos platform
The components can be adopted independently and placed according to runtime, governance, and network requirements.
Cerbos PDP
The Apache 2.0 decision engine runs as a shared service, sidecar, DaemonSet, or selected serverless topology.
Explore Cerbos PDPCerbos Hub
Commercial Cerbos Hub is hosted by default and is available to enterprise customers on-premise for restricted and air-gapped environments. The Cerbos ePDP evaluates Cerbos Hub-managed policy bundles in-process through WebAssembly in JavaScript environments.
Explore Cerbos HubCerbos Synapse
The commercial enrichment and integration layer runs in customer-controlled infrastructure in front of an embedded or external PDP.
Explore Cerbos SynapseCerbos capabilities
Follow the implementation details
These pages document the Cerbos mechanisms referenced throughout this comparison.
Research basis and disclosure
Prepared by the Cerbos team. Facts last checked on .
Each claim was checked against the vendor's or project's own public documentation, pricing pages, and release notes, plus neutral standards and foundation sources. Claims are documented rather than tested firsthand unless the text says otherwise. Where a claim says nothing was found as of a date, it describes an absence of public evidence on that date.
Each row in the comparison table links the Cerbos and Permit.io documentation it relies on. When either product changes, the affected rows are re-checked before this date moves.
Evaluative conclusions are Cerbos's interpretation. Verify current capabilities before deciding.
Alex Olivier, Cerbos cofounder and CPO, is one of the current OpenID Foundation AuthZEN Working Group cochairs. The Cerbos PDP API reference states that it partially implements the AuthZEN Authorization API.
Test the decision
Cerbos is the stronger application-authorization platform
For teams choosing an application-authorization platform, Cerbos is the stronger overall choice because the open source Cerbos PDP, optional Cerbos Hub policy lifecycle, and commercial Cerbos Synapse enrichment form a modular stack with direct policy authoring and deployment control. Permit remains the stronger fit when its low code editor or embeddable Elements are requirements. Verify the choice with one production-shaped rule, the intended PDP topology, policy-update failure tests, and decision logs.