Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

OpenFGA answers the question 'can this user perform this action on this resource?' in single-digit milliseconds, implementing Google's Zanzibar paper as a production-ready authorization engine adopted by Auth0, Grafana Labs, Canonical, Docker, Agicap, and Read.AI. The server exposes both gRPC and HTTP APIs for authorization queries including Check, ListObjects, ListUsers, Expand, and the high-throughput BatchCheck endpoint that deduplicates and processes multiple authorization decisions in a single request. Authorization models combine relationship-based access control with role-based and attribute-based patterns through a purpose-built DSL that supports contextual tuples, conditional relationship tuples with CEL expressions, and time-based filtering via the ReadChanges API. Storage backends include PostgreSQL 14+, MySQL 8, and SQLite in beta, with an in-memory adapter for development and testing. Official SDKs for Java, .NET, Node.js, Go, and Python provide type-safe client integration, while a Terraform provider enables infrastructure-as-code management of authorization stores and models. The built-in browser playground at port 3000 lets developers visually model authorization schemas, write relationship tuples, and test access control queries interactively before deployment. OpenTelemetry instrumentation integrates with existing monitoring infrastructure, and Helm charts simplify Kubernetes deployment. A VS Code extension provides syntax highlighting and validation for FGA model files, and GitHub Actions automate model testing in CI/CD pipelines. A CNCF incubating project with transparent governance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.