Cerbos

What it is for

Cerbos is an authorization desk: you write a YAML policy, a PDP answers allow/deny, and you can run the open-source PDP at $0 or start Cerbos Hub Proof of Concept at $0/month (100 monthly active principals) then Development from $25/month. Use it when the job is policies you start at $0, not when you need a $20 chat seat.

What makes it unique: the cover is the official Cerbos Hub Builds board (commit, build status, deployment labels, Embedded vs Service PDP) from the cloud-docs builds_page still — not a pricing card. The board itself is ops of Hub Builds. Playgrounds are ops of Policies.

Key features

• Policies — the YAML rules a PDP evaluates (policies; How Cerbos works). One file. Resource / principal / derived-role variants and CEL conditions are ops of this. The SDK is install.
• Policy Decision Point — the sidecar or service that answers CheckResources / PlanResources (PDP “Distributed policy decision points”; architecture). A decision, not the YAML. Simultaneous PDP counts on Hub (PoC 2, Development 10) are quotas on this.
• Hub Builds — a git commit compiled into a policy bundle and pushed to PDPs (builds still; pricing policy builds per week). A compile, not a policy you typed. PoC 5/week, Development 100/week, Production unlimited (fair use).
• Audit logs — the decision history you keep (pricing unified audit logs). A record, not a decision. PoC 1 week / Development 3 months / Production 1 year sit on this.
• Self-host PDP / Hub — the Apache-2.0 PDP Free forever, or Hub PoC $0/month → Development from $25/month → Production from $933/month (pricing; GitHub). A control plane, not a policy. Synapse enrichment, in-browser bundles, and managed CI/CD are Hub add-ons, not extra OSS surfaces.

Monthly active principals (users + non-human identities) are the Hub meter, not a feature.

Who it's for

Best fit: app teams who will run the OSS PDP at $0 from disk or git, or start Hub PoC at $0/month (100 MAPs, 2 developers, 5 builds/week) and land on Development from $25/month when they need managed bundle distribution and a 3-month trial.

Pricing

Verified 2026-10-22 (Asia/Shanghai) from cerbos.dev/pricing. Hub is monthly active principals. “From” tiles mean a builder — do not invent a MAP overage dollar that is not printed.

• Open source PDP — $0, “Free forever.” YAML policies, audit logs, CI/CD & IDE tooling, Git/Disk/Cloud/DB storage. Community support. Run the PDP in your environment.
• Proof of Concept (Hub) — $0/month. Up to 100 monthly active principals. 1 workspace, 2 developers, 2 Playgrounds, 2 simultaneous PDPs, 5 custom tenants, 5 policy builds/week, 1 week unified audit logs. Community support.
• Development (Hub) — from $25/month. First 100 MAPs included. 3-month free trial. 3 workspaces, 5 developers, up to 5 Playgrounds, 10 PDPs, 20 tenants, 100 builds/week, 3 months audit logs. Uptime SLA. Live chat.
• Production (Hub) — from $933/month. First 5,000 MAPs included. Unlimited workspaces / developers / Playgrounds / PDPs / tenants / builds (fair use). 1 year audit logs. Uptime SLA. Live chat.
• Enterprise — custom / Contact us. SSO, self-hosted Hub, custom retention, phone support, quarterly training. Confirm the live quote — do not invent an Enterprise dollar.

Confirm checkout; taxes follow your location.

Limitations / costs

• Hub “from $25” / “from $933” is MAP-metered. Past the included 100 / 5,000 principals you are on the builder, not a flat card — the overage dollar is not printed.
• PoC is 5 builds/week and 2 PDPs. A third PDP or a sixth weekly build is Development.
• An authorization desk, not an IdP. For login/SSO see Logto or authentik. For feature flags see Unleash.

Alternatives

• Logto — CIAM / SSO when you need who the user is, not a YAML allow/deny PDP.
• Unleash — feature flags when the gate is a release toggle, not a resource policy.
• GrowthBook — experiment assignment when you are not compiling Cerbos Hub bundles.

Official tutorial

Official Cerbos channel video: How Cerbos works: A high-level overview (oEmbed author: Cerbos). First-party architecture walkthrough; the Hub Builds still is the cover.

Written path: cerbos.dev/pricing plus the builds_page still.

Website

https://www.cerbos.dev

Repository

https://github.com/cerbos/cerbos

Source

Catalog row curated for AI Tools Nav. Cover is the official Cerbos Hub Builds board from the cloud-docs still. Dollars checked on cerbos.dev/pricing (OSS PDP $0; Hub PoC $0/mo; Development from $25; Production from $933). Tutorial oEmbed author: Cerbos.

Last verified

2026-10-22 (Asia/Shanghai) editorial check.