Cerbos Policy Decision Point
The scalable, open source authorization layer for implementing roles and permissions
Do not reinvent
user permissions
access management
authorization
ABAC
RBAC
user permissions
Implement fast, flexible and scalable access control with ease
The Cerbos Policy Decision Point (PDP) provides a simple, yet powerful solution for authorization that can be up and running in minutes. Cerbos PDP helps you separate your authorization process from your core application code, making your authorization system infinitely scalable, more secure and easier to change as your application evolves.
Fast and secure
Plug and play
Developer-friendly
Try it out with the Cerbos Playground
Fast and secure
Flexible deployment models
Self-hosted, compatible with air-gapped, high security environments. Deploy with serverless functions or a sidecar model.
Near-instantaneous response times
Stateless design enabling sub-millisecond policy evaluation without having to synchronize application state or rely on slow network fan-out.
Full auditing and accountability
Compliance with ISO27001, SOC2, and HIPAA with real-time change logs. Keep track of every request and action.
Row-level authorization
Decouple data filtering requests from the code via a query plan API, managed by the same policies as application access.
Plug and play
Designed for full stack architectures
Cerbos PDP uses an API-first approach. Seamlessly integrate with frameworks.
Developer friendly
Define policies in YAML
Human readable configurations for better cross-functional collaboration and communication
Testable with GitOps
Manage, test and deploy fine-grained access control policies using a CI/CD/GitOps workflow.
Management API
Add or update policies using the Cerbos Admin API to simplify administration functions.
No vendor lock-in
As a stateless, self-hosted solution, Cerbos can run on public / private clouds, serverless platforms, or your data center
Where teams go after the open source core
The Cerbos PDP is free to run forever, with no limit on checks or environments, and nothing held back. What you take on yourself is everything else. Testing every policy change, getting it out to every running instance, and keeping a record of every decision someone will ask about later.
 Running Cerbos PDP on its own |  Complete Cerbos platform |
|---|---|
Writing policy Every permission change is a pull request, so product and security wait on an engineer. | Writing policy Product and security change policy themselves, without an engineer in the loop. |
Testing A policy mistake shows up once it is running, and you hear about it from a user who got let in or locked out. | Testing Tests run on every commit and a broken policy never reaches production. |
Keeping instances in sync Instances drift apart, so the same request is allowed in one environment and denied in another. | Keeping instances in sync Every running instance has the same policy within seconds, with no redeploy. |
Audit trail When someone asks who could access what, and when, the answer has to be reconstructed from logs sitting on each instance. | Audit trail Every decision searchable in one place and traceable to the exact policy version, so security has the evidence without asking engineering for it. |
Data for each decision Every service fetches user and resource details itself, so the same lookups get built again in each one. | Data for each decision Your app sends a user ID and the rest is fetched for you from your identity provider or database. |
Note: Moving up is a configuration change, not a rewrite. Building the equivalent of the Cerbos platform around the open source core by yourself is roughly 19 engineer months. See the full comparison.
Access control for every use case
Authorize every identity, govern every action and prove every decision with the Cerbos authorization management platform.
AI systems
authorization
AI systems authorization
Enterprise software
authorization
Enterprise software authorization
Authorization software that scales with your business
ABAC
RBAC
ReBAC
PBAC
Runtime
Event-time
Admin-time
Audit-time
Cloud
Self-hosted
On-premise
Air-gapped
Non-human identities
Human identities
Workloads