grid

Cerbos Policy Decision Point

The scalable, open source authorization layer for implementing roles and permissions

Do not reinvent

user permissions

access management

authorization

ABAC

RBAC

user permissions

The Cerbos Policy Decision Point (PDP) for your software provides a simple, yet powerful solution for authorization that can be up and running in minutes. Cerbos PDP helps you separate your authorization logic from your core application code, making your authorization system infinitely scalable, more secure and easier to change as your application evolves.

Join hundreds of leading companies using Cerbos

The world's leading crypto finance house serving people, projects, protocols and institutions since 2011.
Multiservice utility provider, trusted by over 700,000 customers.
Creating a world where workplaces work better.
A leading youth culture ecommerce and content platform.
The experts in medical imaging technology.
Making the world a better place to work together.
An early stage tech venture investor.
The collaborative platform to build conversational AI.
The intelligence decision action platform.
The fastest development platform.
The leading contract creation and collaboration platform.
One of the world's fastest-growing global technology services provider.
The faster, smarter way to find leveraged finance intelligence.
The only video platform designed to help salespeople break through.
People analytics platform: Fast track to the insights behind your people data.
Advanced malware and phishing analysis.
Leading search intelligence platform for the open web.
Logistics payments without the logistics.
Automated financial operations.
A react-based framework for building internal tools, rapidly.
Superpowered corporate card with built-in instalments.
The data-driven inventory management software for restaurants.
The financial operating system that automates cash.
Making the world a better place to work together.
Build and manage residential investment portfolios.
Securely manage application secrets and configurations.
A discussion-first platform without language issues.
Collaborative team design canvas that equips tech leaders to make smarter org design decisions.
The world's leading crypto finance house serving people, projects, protocols and institutions since 2011.
Multiservice utility provider, trusted by over 700,000 customers.
Creating a world where workplaces work better.
A leading youth culture ecommerce and content platform.
The experts in medical imaging technology.
Making the world a better place to work together.
An early stage tech venture investor.
The collaborative platform to build conversational AI.
The intelligence decision action platform.
The fastest development platform.
The leading contract creation and collaboration platform.
One of the world's fastest-growing global technology services provider.
The faster, smarter way to find leveraged finance intelligence.
The only video platform designed to help salespeople break through.
People analytics platform: Fast track to the insights behind your people data.
Advanced malware and phishing analysis.
Leading search intelligence platform for the open web.
Logistics payments without the logistics.
Automated financial operations.
A react-based framework for building internal tools, rapidly.
Superpowered corporate card with built-in instalments.
The data-driven inventory management software for restaurants.
The financial operating system that automates cash.
Making the world a better place to work together.
Build and manage residential investment portfolios.
Securely manage application secrets and configurations.
A discussion-first platform without language issues.
Collaborative team design canvas that equips tech leaders to make smarter org design decisions.

Configuration over code

Cerbos' human-readable configuration promotes organizational visibility and collaboration, making it easier to enforce security policies and audit compliance requirements. This approach enables seamless cooperation with product management and security teams to update authorization policies without altering core application code.

RBAC, ABAC and more

Cerbos offers context-aware role definitions and attribute-based access control, empowering you to implement adaptable, granular security policies that exceed standard role-based access control.

No vendor or cloud lock-in

As a stateless, self-hosted solution, Cerbos can run on public / private clouds, serverless platforms, or your data center, ensuring 100% control within your perimeter.

Universal integration

Cerbos' language-agnostic API is adaptable across your stack and works in any layer of your application. Whether it's legacy apps, monoliths, microservices, frontend, or backend - you can seamlessly integrate Cerbos into your existing ecosystem.

Full auditing and accountability

Cerbos ensures compliance with ISO27001, SOC2, and HIPAA requirements through real-time change logs for auditing access controls. Integration with security information and event management (SIEM) providers helps mitigate threats to security.

Try it out with the Cerbos Playground

playground

Features

APIs, SDKs and integrations

Implement Cerbos using its API-first approach. Integrate with software by utilizing SDKs for popular languages, or a simple API for other languages. Seamlessly integrate with frameworks.

Deployment models

Self-host Cerbos in your environment. Achieve infinite scalability by deploying Cerbos PDP using serverless functions or a sidecar deployment model. Pick the ideal container orchestration method for you.

Stateless authorization

Deploy, manage and scale authorization without having to synchronize application state or rely on slow network fan-out. Cerbos PDP makes decisions based on the latest data every time.

Testable authorization with GitOps

Manage, test and deploy fine-grained access control policies with confidence using a CI/CD / GitOps workflow. Reduce human errors and enhance security.

Bring your own identity

Use any identity provider to authenticate your users. Use Cerbos to enforce access controls. Cerbos natively supports JWT for integration with numerous authentication providers.

Row-level authorization

Decouple data filtering requests from the code via a query plan API, managed by the same policies as application access, providing consistent and simplified change management of access.

Management API

Add or update policies to the running Cerbos instance using the Cerbos Admin API to simplify administration functions. With Cerbos, policy changes are not just easy, but instantaneous.

Full audit logs

Keep track of every request and action through Cerbos’ comprehensive audit logs, capturing every decision made in the application. Achieve transparency, accountability, and compliance.

What our users say about Cerbos

avatar

Rob, Principal Engineer
@ Utility Warehouse

"It's weird to say an outside company has our back, but Cerbos does. It's the people. It's their open-source code: it's high quality, you can read it, it does what it says on the tin"

avatar

Joe, Software Engineer
@ 9fin

"It's a good feeling being able to say yes to almost any permissioning requirement." "Cerbos is small, contained and easy to implement. It 100% delivers on the promise of abstracting away the complexity of decision making."

avatar

David, Senior Software Engineer
@ Salesroom

"We're not worried about scaling because we can easily increase our load on Cerbos. It will also be easy for us to change how we're distributing policies as we reach different points of scale."

avatar

Joe, CEO & Co-Founder
@ Nook

"We went from one user - every role, to a world where there are many users - many roles. And the product, it relies on Cerbos to actually bring the value that we want to bring to customers. All of our customers are relying on Cerbos, by relying on the product, which is of course relying on Cerbos."

avatar

Chuck, Head of Engineering
@ Salesroom

"Instead of thinking of how much time Cerbos has saved us, I think about how much time it didn't cost us. It didn't cost us any time. Cerbos just works. I don't have to think about it. It's as simple as that."

avatar

Steve, Staff Engineer
@ NTWRK

"One of our big considerations was speed. We have strict latency tolerances. When it comes to Cerbos - you can call it a hundred times during a request and it doesn't matter. It's incredibly fast."

avatar

Engin, Head of Product and Growth & Co-Founder
@ Debite

"If it wasn't for Cerbos, one thing is for sure - we would've launched later than we did. As a result, we would have less customers. And the maintenance part is also very important. Our technical team would be dealing with daily stuff regarding access controls, access logs. Now, we don't have to spend any time on that."

avatar

Rounak, Founding Engineer
@ CommandK

"Cerbos policy writing is quite flexible, and deploying as a unit microservice as well. Cerbos "doesn't get in the way" once integrated, that's the best part."

avatar

Romina, Tech Lead
@ Wizeline

"It is easy to implement and provides a solution for a problem that is often not properly addressed."

avatar

Henry, CTO & Co-Founder
@ Nook

"Having the separation of the permissions from the code base just makes the code base more elegant. It makes the permissioning more elegant. It means they're centralized, so they're not tied to specific endpoints. And ultimately it means that different business owners have the ability to actually make updates."

avatar

Rasmus, CTO
@ Firtal

"Just discovered your embedded testing framework. This is probably the best balance between hyperfocused functionality and embedded tooling I've ever seen in an open source project. Damn, good work!"

Use cases

shield

Application permissions

Fine grained context aware permissions.

shield

Product packaging

Provide trials, feature bundles and custom packages for customers.

shield

Enterprise ready

Manage complex organizational requirements.

shield

Multi-tenant SaaS

Support multiple customer environments at scale.

grid

Unlock full control over policy management with Cerbos Hub

a managed control plane for Cerbos

Low-latency authorization checks

Stateless Cerbos Policy Decision Points (PDP) run in your environment and scale with your application. Deployed as a microservice or binary in your VPC or cluster, or evaluated at edge/on-device via WebAssembly with Cerbos Hub, decisions are always made locally without requiring any lookups or queries to the cloud.

Coordinated rollout and monitoring

Cerbos Hub streamlines policy updates with centralized management, pushing policy changes proactively to all Policy Decision Points for seamless rollouts. Gain insights into deployed ADP instances, tracking active policies, their versions, and more, ensuring all PDPs are synchronized and up-to-date.

Testable authorization powered by GitOps

Write tests along side your authorization logic to ensure complete coverage and expected decisions. Cerbos Hub's CI pipeline compiles, validates and tests every change. Configurable deployment labels enable branch, tag or commit-based rollouts to Policy Decision Points in your environments.

Policy Playground

Cerbos Hub's fully-featured collaborative IDE for developing, iterating and testing policy provides instant feedback on changes, has an automated test runner and integrates into your git-based workflow enabling evolution of authorization policy with ease.

Most popular resources

laptop

Cerbos Policy Decision Point

Want to run authorization yourself?

laptop

Playground

Prototype policies in your browser right now

laptop

Docs

Check out our API reference and guides

laptop

Slack community

Join our community on Slack and learn

laptop

Success stories

Stories of Cerbos in production

laptop

Speak to an engineer

Book an intro call and learn more