Cerbos

Cerbos decouples authorization from application code into a stateless policy decision point (PDP) that runs inside your own infrastructure. Policies are written in human-readable YAML, versioned in Git, tested with a built-in framework, and evaluated with sub-millisecond latency. SDKs cover the major languages, and Cerbos Hub provides a managed control plane for distributing policies and collecting decision logs.

Founded by Emre Baran and headquartered in London, Cerbos positions itself as the developer-loved PDP for teams that want authorization decoupled but not outsourced. The open-source core is genuinely usable on its own; the commercial Hub adds collaboration and observability. In 2026 roundups it consistently ranks among the top self-hosted options for engineering teams that prioritize developer experience and GitOps workflow integration over maximum graph-scale.

The honest trade-off: you run the PDP yourself, and relationship-based (ReBAC) depth is achieved through patterns rather than a native graph like Zanzibar-based systems. Teams whose authorization model is fundamentally about object relationships at Google Drive scale should compare against OpenFGA or SpiceDB-style alternatives.

Deploy the Cerbos PDP binary or container, write policies in YAML, call the Check API from your app.