---
title: "How the Cerbos authorization management platform works"
description: "How the Cerbos authorization management platform works: the four components, the reference architecture, and the path to adopting it one service at a time."
canonical: "https://www.cerbos.dev/how-it-works"
source: "https://www.cerbos.dev/how-it-works"
---

# How the Cerbos authorization management platform works

Authorize every identity, govern every action and prove every decision from one platform. Fine-grained, contextual, and continuous authorization with full audit trails across applications, gateways, workloads, and AI agents.

[Talk to an expert](https://www.cerbos.dev/workshop)

## Cerbos is an end-to-end authorization management platform

Four components work together to give your team a single layer that governs every action and access decision.

- **Cerbos Hub — Policy Administration Point** — Authorization management. Cerbos Hub is the control plane for policy authoring, testing, versioning, distribution, and audit visibility. Hub provides end-to-end policy management out of the box.
- **Cerbos Synapse — Enrichment and Orchestration** — Data and integration. Synapse fetches identity, resource, and relationship data from external systems to enrich authorization requests, and translates infrastructure protocols into Cerbos policy checks.
- **Cerbos PDP — Policy Decision Point** — < 1 ms decision time. PDP is an open source authorization engine that evaluates requests against policies and returns access decisions. It's stateless, high-performance, and built to scale horizontally.
- **Cerbos PEP SDK — Policy Enforcement Point** — Native SDKs. Cerbos PEPs are language-native client libraries that connect applications directly to PDPs to enforce real-time access decisions, with SDKs available for all major languages.

[Cerbos Hub](https://www.cerbos.dev/product-cerbos-hub) · [Cerbos Synapse](https://www.cerbos.dev/product-cerbos-synapse) · [Cerbos PDP](https://www.cerbos.dev/product-cerbos-pdp) · [Cerbos PEP SDK](https://www.cerbos.dev/ecosystem)

## Cerbos reference architecture

The complete picture of Cerbos in production. A defense in depth architecture with consistent enforcement from the edge to the data layer.

> This is where teams grow into, not where they begin. Pick one component, like your API gateway or a single service, and go from there.

[Speak to an engineer](https://www.cerbos.dev/workshop) · [See how it works](https://www.youtube.com/watch?v=f8S111ms-Ck)

## Start with one service

You don't need to roll out Cerbos everywhere on day one. The platform is built for incremental adoption alongside your existing authorization.

1. **Instrument** — Add Cerbos to one service. Set your first policies to allow everything so nothing changes for your users. Your existing authorization keeps running.
2. **Validate** — Cerbos logs every decision it would make. Compare those against what your current system decides, in real time, and tune your policies with real traffic.
3. **Enforce** — When you're confident, turn enforcement on. Expand to the next service from there.

[Book a go-live session](https://www.cerbos.dev/workshop) · [Read documentation](https://docs.cerbos.dev/)