Cerbos is a self-hosted authorization layer for applications and services. Instead of scattering permission checks through application code, teams define access rules once as versioned YAML policies and ask a central policy decision point whether to allow or deny each action. It serves backend and platform teams that need consistent, auditable access control across microservices.[1]
Quick verdict
Microservices teams that want policy-as-code authorization with per-decision audit logs will benefit most from Cerbos. Its central decision point, YAML policies with roles and attributes, and native JWT support directly address scattered permission logic. Teams without developers to write policies and integrate SDKs, or needing a no-code access tool, should choose something else. If you have developers and accept the open-core cost model, choose Cerbos; if you need no-code simplicity, look at simpler alternatives instead.[1][2][3]
Key capabilities
Central policy decision point A stateless PDP returns ALLOW or DENY over gRPC and HTTP APIs, so permission logic lives outside application code.[1]
YAML policy-as-code Versioned policies express RBAC, ABAC, derived roles, and per-principal overrides with contextual data in human-readable files.[1]
Identity-provider flexibility Cerbos consumes identities from any provider with native JWT verification instead of locking teams to one identity vendor.[1]
Centralized audit logs Every authorization decision is recorded centrally, which supports regulated products that must show per-decision history.[1]
Broad deployment targets The PDP ships as binaries, containers, Helm charts, Kubernetes sidecars, systemd services, and serverless functions, including on-prem and air-gapped sites.[1]
Eight-language SDKs Official SDKs cover Go, Java, JavaScript, .NET, Python, PHP, Ruby, and Rust for calling the PDP from application services.[1]
Hub control plane The hosted Hub adds policy management, testing, a playground, decision logs, and audit trails on top of the self-hosted PDP.[1][2]
Standards-aligned APIs Check and Plan APIs plus a documented AuthZEN-aligned posture let teams integrate without inventing a custom authorization protocol.[1]
Who will love it
Microservices teams replacing scattered permission logic: central policies remove duplicated allow-or-deny code across services.[1][2]
Regulated products needing per-decision audit logs: centralized decision records support compliance review without custom plumbing.[1]
Platform teams standardizing on JWT identity: native JWT verification accepts existing providers without migration.[1]
Who should avoid it
Non-technical teams wanting no-code access control: policies are YAML code and integration needs SDK work, so the workflow assumes developers.[1]
Tiny projects with trivial permissions: running a PDP plus policy bundles is more machinery than a simple role check needs.[1]
Teams unwilling to pay per-principal Hub tiers: the PDP is free, but managed Hub value scales with monthly active principals.[1][2]
What the reports suggest
Inspected G2 Cerbos reviews page in October 2026: 4 reviews from engineer, founder, and CTO reviewers with ratings from 4.3 to 5.0.
1 cited community source. Sample of four cannot establish prevalence; difficulty or disagreement reports may be underrepresented; no verbatim quotes are reused in this revision.
The small G2 sample skews positive, with recurring themes of ease of learning, replacing scattered permission logic, and faster authorization decisions, including one reviewer's claim of about 80 percent time savings. Four reports cannot establish how typical these outcomes are.[1]
Fit and compatibility
Services call the PDP over gRPC or HTTP from eight official SDKs, and policies bundle with contextual data for attribute-based decisions.[1]
The stateless PDP fits containers, Kubernetes sidecars, serverless functions, and air-gapped sites, while policy management and audit trails live in the hosted Hub.[1]
Questions worth asking
What is the best Cerbos alternative for non-technical users?
Cerbos assumes developers: policies are YAML code and applications integrate through SDKs. Non-technical teams should evaluate simpler managed alternatives with visual administration rather than adopting this workflow.[1]
Is Cerbos really no-code?
No. Policies are written as YAML code and services integrate through SDKs. The Hub adds testing and playground conveniences but does not remove the developer workflow.[1]
How much does Cerbos cost per month?
Can you self-host Cerbos?
Yes. The PDP is designed to be self-hosted from binaries, containers, Helm charts, Kubernetes sidecars, systemd services, or serverless functions, including on-prem and air-gapped deployments. Managed Hub features remain hosted.[1]
Sources and editorial review
Source research. Reviewed on October 9, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
Inspected G2 Cerbos reviews page in October 2026: 4 reviews from engineer, founder, and CTO reviewers with ratings from 4.3 to 5.0. Sample of four cannot establish prevalence; difficulty or disagreement reports may be underrepresented; no verbatim quotes are reused in this revision.
- Cerbos documentation home
official · Observed October 9, 2026
Official documentation home: PDP/Hub/Synapse structure, 8 SDKs, policy bundles, playground, AuthZEN, deployment targets (binary, container, K8s, serverless, systemd, on-prem, air-gapped).
- Cerbos pricing
official · Observed October 9, 2026
Official pricing page: open-core model, PDP free forever, Hub Development and Production tiers priced per monthly active principal; vendor-supplied customer quotes not reused as testimonials.
- Cerbos reviews on G2
community · Observed October 9, 2026
G2 product reviews page: 4 reviews, ratings 4.3 to 5.0, vendor-listed pricing tiers; no verbatim quote text retained so no testimonial reuse.