Cerbos

Cerbos is an open-source, self-hosted platform that provides an externalized authorization layer for applications. It allows developers to define access control rules for application resources using YAML policies, which separates permission logic from the core application code. This architecture ensures that authorization rules can be updated and managed independently of the primary application deployment cycle.

The software is deployed as a Policy Decision Point (PDP), which is a stateless service that evaluates requests and returns access decisions. It can be run as a Kubernetes service or sidecar, a systemd service, or as an AWS Lambda function. Applications interact with the PDP via APIs or available SDKs to determine if a principal can perform a specific action on a resource, moving the decision process away from the business logic layer.

Key features

• Definition of access rules using structured YAML policies
• Support for both Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC)
• Dynamic role assignment through derived roles based on contextual data
• CheckResources API to verify if a principal can access a specific resource
• PlanResources API to determine which resources of a certain kind a principal can access
• Policy storage options including local disk, cloud object stores, git repositories, and databases
• Integration with Cerbos Hub for policy authoring and distribution
• Support for serverless and edge deployments via an embedded PDP

Written in Go, Cerbos is designed for scalability and high availability. It uses a principal, action, and resource model to evaluate permissions, making it suitable for complex systems where access depends on runtime attributes. The system integrates into Git-ops workflows, allowing policies to be versioned and deployed alongside the application infrastructure. For teams requiring more coordination, the Cerbos Hub provides a cloud-hosted control plane for testing policies in interactive playgrounds and distributing updates to a fleet of PDPs.

Cerbos serves as a dedicated security layer for organizations requiring fine-grained permissions management without hardcoding complex logic into their services.