Cerbos

Cerbos is an authorization company that externalizes access control from application code into a dedicated policy layer. Its core component, the Cerbos Policy Decision Point (PDP), is an open source, stateless, language-agnostic authorization engine that evaluates requests against policies written in YAML using CEL expressions and returns access decisions. Policies define principals (users, applications, services or bots), actions and resources, and can be stored on disk, in cloud object stores, git repositories or supported databases. The PDP exposes two primary APIs — CheckResources ("can this principal access this resource?") and PlanResources ("which resources of a given kind can this principal access?") — and can run as a Kubernetes service or sidecar, a systemd service, or an AWS Lambda function. Query plan adapters convert PlanResources responses into database query instances for row-level filtering.

Around the PDP, Cerbos sells a broader authorization management platform. Cerbos Hub is a cloud-hosted control plane and Policy Administration Point covering policy authoring, testing, versioning, distribution to PDP fleets, collaborative private playgrounds, audit visibility, and embedded PDP bundles for browser, serverless and edge deployment. Cerbos Synapse handles enrichment and orchestration, fetching identity, resource and relationship data from external systems and translating infrastructure protocols into Cerbos policy checks. Policy Enforcement Point SDKs are provided as language-native client libraries for JavaScript, Python, Go, Rust, Java, .NET, Ruby, PHP and others.

The platform supports RBAC, ABAC, ReBAC and PBAC models, with derived roles that assign roles dynamically from contextual data and principal policies for per-user overrides. Deployment options span cloud, self-hosted, on-premise and air-gapped environments. Cerbos positions itself as the layer that governs what identities can do after authentication, complementing identity providers and identity governance tools, and covers human identities, service accounts, non-human identities, workloads and AI agents, including guardrails for MCP servers, RAG authorization and AI gateway governance. Decision logging captures the requester, action, resource, outcome and the specific policy version behind each decision to support SOC 2, SOC 3, ISO 27001, HIPAA, GDPR, PCI DSS, NIS2, DORA and FedRAMP audit requirements.

Founding story

Co-founders Emre Baran and Charith Ellawala met at Qubit, a UK startup co-founded by Baran that was later acquired by Coveo. Across prior roles at companies including Google, Elastic and CGI, they repeatedly encountered developers having to write bespoke authorization code for each system, and started Cerbos in early 2021 in London to remove that work by providing a reusable authorization layer. Alex Olivier is the third co-founder. The company name derives from Cerberus, chosen during discussions about protection and guard dogs; the shortened form became Cerbos and the mascot Cerbie.

Business model

Cerbos operates an open core model. The Cerbos Policy Decision Point is open source and self-hosted, while commercial offerings layer management, distribution and audit capabilities on top: Cerbos Hub as a control plane for policy authoring, testing, versioning, distribution and audit visibility, and Cerbos Synapse for data enrichment and protocol orchestration. The company describes its software as partly open source and partly commercial, designed to work together, and has stated an intent to build an enterprise-grade product alongside the cloud service.

Revenue comes from commercial products layered on the open source PDP. Cerbos Cloud pricing at private beta was based on monthly active principals — humans or machines seeking access to an access-controlled system — with the company testing multiple pricing levels and planning an enterprise-grade offering informed by cloud learnings.

Traction

Cerbos reports that its software runs inside thousands of companies and processes over two billion authorization checks per month. The open source repository has approximately 4,600 GitHub stars, 208 forks and more than 2,600 commits. By late 2021 the company had open sourced its codebase and acquired multiple production customers, and it shipped roughly 19 iterations of its core platform between its first seed round and the April 2023 Cerbos Cloud launch. Public customer references include Utility Warehouse, 9fin, Salesroom, Nook, Complex, Debite, CommandK, Wizeline and Firtal.

Latest developments

Cerbos has extended its platform beyond the open source PDP with Cerbos Hub as a policy administration control plane and Cerbos Synapse for enrichment and orchestration, and has repositioned around governing AI agent and MCP access, including pre-deployment guardrails, RAG authorization, AI gateway governance and rapid policy-based revocation. The company reports processing over two billion authorization checks per month and states that the OpenID AuthZEN specification, to which its PDP conforms, was ratified in January 2026.