Technical decision brief
Cerbos vs Permit.io
Both products target application teams. In its standard hosted model, Permit.io pairs a managed control plane with an open source PDP. Cerbos can run a self-hosted Cerbos PDP from hand-authored policy files with no control plane required for decisions, while Cerbos Hub and Cerbos Synapse add commercial management and enrichment capabilities.
The decision
Choose Cerbos when
- Choose Cerbos when the default should be a modular authorization platform: an independently deployable open source PDP, optional Cerbos Hub policy lifecycle, and commercial Cerbos Synapse enrichment.
- The application team wants YAML or JSON policy with CEL rather than generated Rego or Cedar.
- Policy lifecycle management and decision-time data enrichment should remain separate, optional platform concerns.
Choose Permit.io when
- A low code policy editor is the preferred authoring surface for developers and nondeveloper stakeholders.
- Embeddable access request, approval, and user management components are product requirements.
- OPAL-based policy and data distribution matches the operating model the team wants.
At a glance
What developer teams ask for
The table describes documented mechanisms. It does not assign winner scores.
| Requirement | Cerbos | Permit.io |
|---|---|---|
| Source of truth for policy | Treats hand authored files in your repository as the authoritative artifact, reviewed and tested like any other code. | Supports cloud UI, API, SDK, IaC, direct code, and customer-owned Git workflows. UI changes generate Rego or Cedar. |
| Evidence for Source of truth for policy | ||
| Policy language | Authors policy directly in YAML or JSON with CEL expressions, without requiring users to maintain generated Rego or Cedar. | Generates Rego or Cedar beneath the low code editor and also supports direct custom policy code. |
| Evidence for Policy language | ||
| Self hosting and cloud dependency | The standalone Cerbos PDP needs no control plane for authoring or decisions. It can run air-gapped with local storage and telemetry disabled; enterprise Cerbos Hub also has an on-premise option. | Supports local Edge PDPs with a cloud control plane. The Enterprise plan also offers the complete control plane on-premise as a multiservice platform. |
| Evidence for Self hosting and cloud dependency | ||
| Embeddable end user access UI | No prebuilt UI components. Applications build access request and user management workflows on Cerbos Hub policy stores, updating policies programmatically through the Cerbos Hub API and SDKs for Go, JavaScript, Python, Java, .NET, PHP, and Rust — documented for per-tenant roles and user-defined permissions. | Ships Permit Elements, embeddable components for access requests, approvals, and user management. A genuine differentiator. |
| Evidence for Embeddable end user access UI | ||
| Keeping decision data fresh | Licensed Cerbos Synapse supports decision-time enrichment from SQL and extension-defined HTTP, IdP, or graph sources, with in-memory or Redis caching. | Distributes policy and external data to deployed policy agents in real time through Apache 2.0 OPAL. |
| Evidence for Keeping decision data fresh | ||
| List filtering and query planning | Exposes PlanResources plus six documented query-plan adapters for applying filters in the application datastore. | Supports object filtering, OPA partial evaluation, and a Prisma extension. Evaluate policy-model and adapter coverage for your stack. |
| Evidence for List filtering and query planning | ||
| AuthZEN compatibility | The Cerbos PDP partially implements the AuthZEN API, and Cerbos Synapse exposes the Cerbos API in front of an embedded or external Cerbos PDP. Alex Olivier, Cerbos cofounder and CPO, is one of the current AuthZEN Working Group cochairs. | Participated successfully alongside Cerbos in the OpenID AuthZEN interoperability testing published in May 2024. |
| Evidence for AuthZEN compatibility | ||
| Open source and pricing transparency | Publishes the Cerbos PDP under Apache 2.0 with public pricing and a free tier. Cerbos Hub and Cerbos Synapse are commercial add-ons. | Publishes the PDP and OPAL under Apache 2.0 and SDKs under Apache 2.0 or MIT, depending on the SDK. The hosted control plane is proprietary. |
| Evidence for Open source and pricing transparency | ||
Deep dive 1
Ownership starts with the source artifact
Both products support code and Git workflows, but their default authoring paths produce different operational ownership.
Permit supports a cloud UI, API, SDK, IaC, direct code, and customer-owned Git. Changes made through its UI generate Rego or Cedar. That model is useful when policy editors must serve a mixed technical and nontechnical audience.
A standalone Cerbos PDP reads policies authored directly in YAML or JSON with CEL. The repository can remain the authoritative artifact, with review and tests following the application's existing delivery workflow.
Cerbos Hub is optional for the decision path. It adds ingestion, validation, testing, signed bundle distribution, fleet visibility, and audit. Cerbos Hub Enterprise can run on-premise in restricted or air-gapped environments.
Deep dive 2
The control plane and the decision path are separate choices
The products can both place a PDP near the application, but the surrounding dependencies differ.
Permit offers managed Cloud PDPs and Edge PDP containers. The Edge PDP normally receives policy and data updates through the configured Permit control plane and OPAL.
The standalone open source Cerbos PDP can evaluate from local or Git-backed policy storage without contacting Cerbos Hub. A sidecar or service deployment keeps the synchronous request inside the application's infrastructure. For supported JavaScript environments, Cerbos Hub's commercial ePDP downloads Cerbos Hub-managed bundles and evaluates them in-process through WebAssembly, with no per-decision service call.
Permit also offers an enterprise on-premise control plane. The decision is therefore not simply cloud versus self-hosted. Compare the number of components, policy distribution path, failure behavior, and which team operates each component.
Deep dive 3
Data distribution and decision-time enrichment solve different problems
OPAL distributes data to policy agents; Cerbos Synapse retrieves context when a decision is evaluated.
OPAL is an Apache 2.0 distribution engine for policy and external data. It fits systems that want policy agents to receive updates before a check is made.
Commercial Cerbos Synapse runs in customer-controlled infrastructure. It can retrieve and transform identity, resource, or relationship context at decision time, with configured caching, before an embedded or external Cerbos PDP evaluates policy.
Neither mechanism removes data-lifecycle design. Teams still need to define authoritative sources, acceptable staleness, cache behavior, and failure handling.
Implementation
Map the operating model before moving policy
A migration can preserve existing application enforcement points while changing authoring, distribution, and context retrieval independently.
| Permit.io concept | Cerbos | Migration or coexistence note |
|---|---|---|
| Policy editor and generated Rego or Cedar | Directly authored YAML or JSON policies with CEL conditions | Translate the effective rules and tests, not the generated source line by line. |
| Cloud PDP or Edge PDP | Self-hosted Cerbos PDP as a sidecar, DaemonSet, or service | Keep the existing PEP and replace its authorization client at one boundary first. |
| Permit control plane and OPAL updates | Local or Git policy storage, or optional Cerbos Hub bundle distribution | Select the policy path independently from the runtime decision topology. |
| Distributed external authorization data | Request attributes supplied by the application or fetched through Cerbos Synapse | Choose per datum whether the caller or customer-controlled Cerbos Synapse owns freshness. |
A local decision path with optional management
- 1
1. Author
Engineers edit Cerbos policy and tests directly in the source repository.
- 2
2. Distribute
The Cerbos PDP reads local or Git-backed policy, or receives a signed bundle from Cerbos Hub.
- 3
3. Check
The application sends principal, action, resource, and current attributes to its local Cerbos PDP.
- 4
4. Enforce
The application applies the allow or deny response without a hosted control-plane call.
Cerbos Hub can manage the lifecycle without becoming a mandatory synchronous dependency. Cerbos Synapse is added only when decision-time enrichment is required.
Deployment
Deployment control spans the Cerbos platform
The components can be adopted independently and placed according to runtime, governance, and network requirements.
Cerbos PDP
The Apache 2.0 decision engine runs as a shared service, sidecar, DaemonSet, or selected serverless topology.
Explore Cerbos PDPCerbos Hub
Commercial Cerbos Hub is hosted by default and is available to enterprise customers on-premise for restricted and air-gapped environments. The Cerbos ePDP evaluates Cerbos Hub-managed policy bundles in-process through WebAssembly in JavaScript environments.
Explore Cerbos HubCerbos Synapse
The commercial enrichment and integration layer runs in customer-controlled infrastructure in front of an embedded or external PDP.
Explore Cerbos SynapseCerbos capabilities
Follow the implementation details
These pages document the Cerbos mechanisms referenced throughout this comparison.
Research basis and disclosure
Claims were reviewed against public product documentation, official project material, and standards sources on 24 July 2026.
The links beside each row point to Cerbos or neutral standards sources. Evaluative conclusions are Cerbos's interpretation; verify current capabilities before deciding.
Competitor documentation informed this comparison but is not linked from this page. Cerbos documentation and neutral standards or foundation sources were checked separately.
Alex Olivier, Cerbos cofounder and CPO, is one of the current OpenID Foundation AuthZEN Working Group cochairs. The Cerbos PDP API reference states that it partially implements the AuthZEN Authorization API.
Test the decision
Cerbos is the stronger application-authorization platform
For teams choosing an application-authorization platform, Cerbos is the stronger overall choice because the open source Cerbos PDP, optional Cerbos Hub policy lifecycle, and commercial Cerbos Synapse enrichment form a modular stack with direct policy authoring and deployment control. Permit remains the stronger fit when its low code editor or embeddable Elements are requirements. Verify the choice with one production-shaped rule, the intended PDP topology, policy-update failure tests, and decision logs.