cerbos/cerbos
Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage by writing context-aware access control policies for your application resources. observed · 2026-08-28
Health v2 · maintenance only
94/100
- Activity 99
- Release rhythm 85
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 31
- age_days: 1991
- days_rel: 20
- days_push: 8
- n_releases_24m: 18
Adoption not part of the score
4555 stars · 208 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
Cerbos is an open-core, language-agnostic policy decision point (PDP) that externalizes authorization from application code using context-aware YAML policies for RBAC, ABAC, and ReBAC. Applications call its API to get ALLOW/DENY decisions, with policies stored in Git, disk, object stores, or databases and managed via GitOps or the commercial Cerbos Hub.
Use cases
- externalize authorization logic from application code into YAML policies
- implement fine-grained RBAC and ABAC permissions for app resources
- control which MCP tools AI agents can access
- enforce user-level permissions in RAG retrieval pipelines
- manage per-tenant custom permission policies in a SaaS
- audit every access decision for SOC 2 or HIPAA compliance
- update permissions without redeploying the application
When to choose
- you want authorization decisions separated from application code and managed as version-controlled policy files
- you need context-aware, fine-grained access control across many services or languages
- you must secure AI agents, MCP servers, or RAG pipelines with policy-driven guardrails
- you need per-tenant dynamic permissions in a multi-tenant SaaS
- you want a stateless, self-hosted PDP that scales horizontally
When to avoid
- you only need simple role checks that a few if-statements can handle
- you want authentication or identity provisioning - Cerbos authorizes but does not authenticate
- you require a fully open-source control plane without the commercial Cerbos Hub
- you cannot run an additional network service next to your application
Facets
service · maturity stable
authorization security api-framework middleware security backend apis large-language-models developer-tools go self-hosted cloud cross-platform windows policy-engine pdp access-control rbac abac rebac yaml-policies mcp-authorization rag-authorization policy-as-code gitops audit-logging multi-tenancy zero-trust ai-agents docker kubernetes linux macos
10 sources
- readme: https://github.com/cerbos/cerbos · fetched 2026-08-28 · 1737de61f62c
- homepage: https://cerbos.dev · fetched 2026-08-29 · fed20590fd21
- site_page: https://www.cerbos.dev/features-benefits-and-use-cases/agentic-authorization · fetched 2026-08-29 · da905e910ba0
- site_page: https://www.cerbos.dev/features-benefits-and-use-cases/dynamic-authorization-for-MCP-servers · fetched 2026-08-29 · e56e1544a849
- site_page: https://www.cerbos.dev/features-benefits-and-use-cases/access-control-for-rag · fetched 2026-08-29 · 1ba6470246e2
- site_page: https://www.cerbos.dev/features-benefits-and-use-cases/ai-gateway-authorization · fetched 2026-08-29 · a31627e711e4
- site_page: https://www.cerbos.dev/features-benefits-and-use-cases/application-permissions · fetched 2026-08-29 · a1e3247d3166
- site_page: https://www.cerbos.dev/features-benefits-and-use-cases/per-tenant-custom-policies · fetched 2026-08-29 · d805e34125ff
- site_page: https://www.cerbos.dev/features-benefits-and-use-cases/dynamic-policies · fetched 2026-08-29 · 6a6e2d10715d
- site_page: https://www.cerbos.dev/pricing · fetched 2026-08-29 · 41778bdbcfee
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| cerbos/cerbos | main | 94 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem