Logo
Deploy Now

Categories

Developer Tools Security API Authorization Compliance Access Control Policy Engine

Stars

4,550

Forks

206

Watchers

34

Developer links

Last Updated: 08-23-2026 12:35 AM (UTC)

Cerbos

Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Cerbos
Cerbos
Cerbos
Cerbos
Cerbos

Benefits

  • Sub-Millisecond Stateless Decisions
  • Custom decision engine evaluates context-aware policies in under one millisecond without application state synchronization, delivering up to 17x faster performance than OPA-based alternatives.
  • Eight-Language SDK Coverage
  • Official Policy Enforcement Point SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby integrate authorization checks as single function calls in any tech stack.
  • GitOps Policy Lifecycle Management
  • Git-native workflows with CI validation, coverage reports, breaking-change detection, and audit logging enable policy versioning and compliance for ISO27001, SOC2, and HIPAA requirements.
  • Universal Deployment Flexibility
  • Runs as Kubernetes sidecar, standalone service, systemd daemon, AWS Lambda function, or WebAssembly-embedded PDP in browsers, serverless architectures, and edge computing devices.

Features

  • Google CEL Policy Conditions
  • YAML policies with Google Common Expression Language conditions enabling context-aware access decisions using derived roles, scoped policies, and resource attributes.
  • Permissions-Aware Data Filtering
  • Authorization predicates translate into database query filters, pushing access control directly to data sources for efficient permissions-aware data retrieval.
  • Interactive Policy Playground
  • Built-in Playground and REPL environments for interactive policy authoring, testing, and debugging with real-time syntax validation and decision evaluation.
  • Admin Management API
  • Programmatic policy lifecycle management through REST and gRPC Admin APIs for adding, updating, and disabling policies without service restarts.
  • Dual-Protocol Service APIs
  • Both gRPC and HTTP/REST check endpoints accept authorization requests with user context, resource attributes, and action metadata for language-agnostic integration.