#6 in Identity & Access ManagementUpdated 2026-08

Cerbos

by Cerbos · Externalised policy-based authorization for applications, services and AI agents

67.3 — BenchRank score out of 100

Homepage
Pricing page

Visit website See full Identity & Access Management ranking

Overview

Cerbos is an authorization platform that separates access-control logic from application code. Its open-source Policy Decision Point evaluates YAML policies at runtime and returns allow/deny decisions to applications through language SDKs. Cerbos Hub adds central policy authoring, testing, versioning and audit logs; Cerbos Synapse enriches requests with data from external systems.

Best for: Engineering teams moving fine-grained permissions out of application code and into central policy
Pricing: The open-source PDP is free; Cerbos Hub offers a $0 proof-of-concept tier, then from $25/month (Development) and from $933/month (Production), with custom Enterprise pricing on request.
Runs on: Self-hosted

Strengths and trade-offs

Strengths

Open-source PDP runs on-prem, in cloud or air-gapped
SDKs for JS, Python, Go, Rust, Java and .NET
RBAC, ABAC, ReBAC and PBAC without application code changes
Audit logs record the policy and version behind each decision

Trade-offs

Production plan starts at $933/month and scales with active principals
SSO, self-hosted Hub and custom log retention are Enterprise-only
Free and proof-of-concept tiers get community support only, with no SLA
Proof-of-concept tier caps use at 1 workspace, 2 developers and 2 PDPs

Pricing

Published plans from Cerbos’s own pricing page, in USD. Usage charges and add-ons may apply on top.

Cerbos pricing tiers, monthly rates in USD
Plan	Monthly	Includes
OPEN SOURCE	—	Free forever, run on-premise or in cloud YAML-based policy definition and audit logs CI/CD and IDE tooling; Git, disk, cloud or DB storage Community support
PROOF OF CONCEPT	—up to 100 monthly active principals	$0/month, up to 100 monthly active principals 1 workspace, 2 developers, 2 simultaneous PDPs 5 policy builds per week, 1 week of unified audit logs Community support
DEVELOPMENT	$25per month, first 100 monthly active principals included	3 workspaces, 5 developers, up to 10 simultaneous PDPs 100 policy builds per week, 3 months of audit logs Uptime SLA and live chat support 3 months free trial
PRODUCTION	$933per month, first 5,000 monthly active principals included	Unlimited workspaces, developers, PDPs and tenants Unlimited policy builds, subject to fair usage 1 year of unified audit logs Uptime SLA and live chat support
ENTERPRISE	Contact sales	SSO support and self-hosted Cerbos Hub Custom audit log retention Enterprise support SLA and phone support Custom and quarterly training

How this score is made up

Each dimension is scored out of 100 and combined into the headline score using fixed weights.

MCP support: 60 out of 100
API quality: 30 out of 100
Documentation: 90 out of 100
Agent friendliness: 73 out of 100
Pricing transparency: 85 out of 100
Changelog: 100 out of 100
Marketing site structure: 50 out of 100
Operational trust: 75 out of 100

Measured, but not part of the score

Useful to know, but not a mark for or against the product — so these do not affect the ranking.

Openness: 85 out of 100
Maintenance: 100 out of 100

This doesn’t look right — report a problem with Cerbos’s score

Alternatives in Identity & Access Management

Ranked 1
75.9 — BenchRank score out of 100
Ory
Ory · API-first identity and access management, self-hosted or managed
Best for: Engineering teams wanting API-first identity and access management they can self-host or buy as SaaS
Ranked 2
73.8 — BenchRank score out of 100
Logto
Logto · Open-source auth infrastructure with SSO, RBAC and multi-tenancy
Best for: Developers adding auth, enterprise SSO and multi-tenancy to SaaS or AI apps without building it
Ranked 3
73.1 — BenchRank score out of 100
Hexclave
Hexclave · Open-source auth, payments, email and analytics building blocks
Best for: Startups wanting auth, payments, emails and analytics as one open-source, self-hostable platform.