Blog
Demos, implementation guides, product updates and broader takes on authorization, identity and security. Written for the engineers, architects, security, identity and product leaders shaping how their teams ship and govern access.
Replacing jump-box privileged access with policy-based authorization at the API gateway
Most privileged access still runs through a jump box. This guide shows how to replace it for API-shaped work with policy-based authorization, grants bounded by time, endpoint, object and quota, enforced at the gateway, with a decision log for every call. Includes a CEL policy example and where the pattern stops.
ISC2 Security Congress 2026: Software supply chain security starts with identity
Most software supply chain attacks start with an identity that could do too much. Alex Olivier and Vatsal Gupta of Apple walk through a CI/CD breach, scoped OIDC trust policies, segmented pipeline identities, contextual authorization and risk-adaptive access that keeps engineers moving.
Cerbos featured in the GigaOm Radar for Security Policy as Code
Cerbos is featured in the GigaOm Radar for Security Policy as Code. How access rules inside your product get reviewed in pull requests, tested in CI, and logged for audit.
Authorize outbound model calls before they leave the network
An API key is a binary, so it says nothing about what a caller may ask for, what a request may cost, or whether the file an assistant is about to read should leave the network. Covers authorizing outbound LLM calls at the egress point, and what the control misses.
Human-in-the-loop approval for AI agents: Cerbos partners with iProov
Human-in-the-loop approval for AI agents, with Cerbos and iProov. How policy checks each agent action, when a named approver confirms it with a live genuine human presence check, which actions should need sign-off, and what goes into your audit trail.
Migrating from PlainID to Cerbos
A practical guide to migrating from PlainID to Cerbos. Map PlainID policies, assets and attribute sources to Cerbos, translate a policy with passing tests, replace PDP and Authorizer calls, run both side by side in shadow mode, and cut over one service at a time.
Code Story podcast: Alex Olivier on building Cerbos, AI agents, and authorization on every request
Alex Olivier on the Code Story podcast, covering how Cerbos started after he rebuilt permissions at several companies, how the user community shaped the product, and why AI agents need access checked on every call, not only at login.
PlainID alternatives
PlainID alternatives for enterprises centralizing authorization. What PlainID does and costs, why teams look elsewhere, which tools on alternatives lists actually replace it, the questions to ask any replacement, and how to switch without a big bang cutover.
Cerbos vs PlainID
Cerbos vs PlainID compared for enterprise authorization programs. How each platform handles policy authoring and review at scale, where decisions run, coverage of gateways, data platforms and AI agents, audit evidence, standards and pricing, with a path for moving from PlainID to Cerbos.
Cerbos PDP v0.57.0: Presence checks in query plans, smoother store reloads, lighter Cerbos Hub audit log sync
Cerbos PDP v0.57.0 adds a has operator to query plans so attribute presence checks reach your data layer, keeps large policy stores serving requests during full reloads, and cuts CPU, memory and disk use in Cerbos Hub audit log sync. Includes upgrade notes for query plan handlers.
Migrating from Oso to Cerbos
A practical guide to migrating from Oso Cloud or the deprecated oso library to Cerbos. Covers the Polar to Cerbos concept mapping, a worked translation with passing tests, moving facts to request attributes or Cerbos Synapse, list filtering with query plans, and proving parity before cutover.
How we use Cerbos inside Cerbos: Authorizing MCP tool calls
A real internal MCP server authorization setup, from the team that builds Cerbos. See how we give every tool call a named person, separate the person from the workload acting for them, gate warehouse queries and web access in policy, and ship policy changes through Cerbos Hub without redeploying.
Cerbos included in The Forrester Tech Tide™: Identity And Access Management, Q1 2026
Cerbos is included in The Forrester Tech Tide™: Identity And Access Management, Q1 2026. Why the access rules inside your applications belong under identity governance, and a quick check to see where yours live.
AI coding agent authorization should not depend on who runs it
Coding agent permissions set by an approval prompt belong to one developer, on one machine, until someone turns the prompts off. Covers AI coding agent authorization decided centrally instead, what the COAZ draft formalizes, shell escapes a hook never sees, and the missing approval path.
What is AIAM? AI identity and access management explained
AIAM is IAM for AI agents. What it covers, why IAM built for humans breaks for agents, and why identity is the input and authorization is the enforcement.
SoftwarePlaza podcast: Emre Baran on deterministic authorization for probabilistic AI agents
Emre Baran on the SoftwarePlaza podcast, covering why if-then-else permission checks break in microservices, an approval policy with limits by seniority and region, the checks an AI agent request should pass, and a refund policy that stops prompt injection.
Cerbos vs Oso
Comparing Cerbos and Oso? This guide covers where authorization data lives, where decisions run, policy language, RBAC, ABAC and relationship handling, list filtering, audit evidence and pricing, with an honest view of when Oso Cloud still fits and when Cerbos is the better choice.
Best IAM solutions for enterprises in 2026
The best IAM solutions for enterprises, broken down by domain. Access management, identity governance, privileged access, machine identity, and authorization, with the notable vendors in each and how to choose, including the fine-grained authorization layer most enterprise identity programs leave hardcoded.
Recommended content
Mapping business requirements to authorization policy
eBook: Zero Trust for AI, securing MCP servers
Experiment, learn, and prototype with Cerbos Playground
eBook: How to adopt externalized authorization
Framework for evaluating authorization providers and solutions
