Cerbos authorization for FusionAuth
Use FusionAuth's flexible user data model, application roles, and custom data fields to drive fine-grained authorization decisions in Cerbos.
Per-app role policies
Use FusionAuth's per-application role assignments to write authorization rules scoped to each application registration
Custom data in policies
Reference FusionAuth user.data and registration.data fields directly in Cerbos policy conditions
Multi-tenant ready
Combine FusionAuth tenant isolation with Cerbos scoped policies for per-tenant authorization logic
How Cerbos works with FusionAuth
FusionAuth handles authentication, confirming who a user is. Cerbos handles authorization, deciding what that user can do. Together they give you a complete access control stack without coupling identity logic to business rules.
Cerbos lets you write fine-grained, context-aware authorization policies in human-readable YAML. Policies are decoupled from application code so product and security teams can update permissions without a release cycle.
Because Cerbos runs as a stateless Policy Decision Point (PDP) next to your application, authorization checks are sub-millisecond and scale horizontally with your infrastructure.
Authorization powered by FusionAuth's flexible data model
FusionAuth gives developers full control over their user data model: per-application role assignments, custom data fields on users and registrations, multi-tenant isolation, and JWT lambdas for claim customization. Cerbos uses that rich identity data to make fine-grained authorization decisions at the resource level.
How it works
- Users authenticate through FusionAuth, your application receives a JWT containing application roles, group memberships, and custom claims populated by lambdas.
- Your application extracts identity data and passes it to Cerbos as principal attributes, alongside the target resource and action.
- Cerbos evaluates policies that reference FusionAuth roles, custom user data, tenant context, and resource properties.
- Your application enforces the result, keeping authorization logic in declarative policies rather than application code.
Beyond simple role checks
FusionAuth's role system is application-scoped, which is a good starting point. But many applications need authorization decisions that depend on the specific resource being accessed, the relationship between the user and the resource, or contextual data like time or location. Cerbos policies express these rules using the identity data FusionAuth provides.
Get started
Watch our demo video or explore the Express + FusionAuth + Cerbos example project to see the integration in action.
FAQ
Can Cerbos use FusionAuth application registrations?
Yes. FusionAuth assigns roles per application registration, so a user can have different roles in different applications. Your application passes the registration-specific roles to Cerbos, and policies can scope authorization decisions to the correct application context.
How does Cerbos work with FusionAuth's user.data fields?
FusionAuth lets you store arbitrary key-value data on user objects and application registrations. When included in JWT claims via lambdas, this custom data can be passed to Cerbos as principal attributes and used in policy conditions.
Does Cerbos support FusionAuth multi-tenant setups?
Yes. FusionAuth's tenant ID and tenant-specific user data can be passed as principal attributes to Cerbos. Policies can then enforce different access rules per tenant without duplicating policy logic.
Learn more about Cerbos
Related integrations
View all integrations →
Cerbos + FusionAuth
- Cerbos extends FusionAuth roles with fine-grained, attribute-based permissions
- Policies defined in human-readable YAML, managed as code
- Authorization logic decoupled from application code
- Sub-millisecond policy evaluation via stateless PDP
Authorization for AI systems
By industry
By business requirement
Useful links
What is Cerbos?
Cerbos is an end-to-end enterprise authorization software for Zero Trust environments and AI-powered systems. It enforces fine-grained, contextual, and continuous authorization across apps, APIs, AI agents, MCP servers, services, and workloads.
Cerbos consists of an open-source Policy Decision Point, Enforcement Point integrations, and a centrally managed Policy Administration Plane (Cerbos Hub) that coordinates unified policy-based authorization across your architecture. Enforce least privilege & maintain full visibility into access decisions with Cerbos authorization.