Tech blog
Demos, implementation guides, product updates and broader takes on authorization, identity and security.
Cerbos vs PlainID
Cerbos vs PlainID compared for enterprise authorization programs. How each platform handles policy authoring and review at scale, where decisions run, coverage of gateways, data platforms and AI agents, audit evidence, standards and pricing, with a path for moving from PlainID to Cerbos.
Cerbos PDP v0.57.0: Presence checks in query plans, smoother store reloads, lighter Cerbos Hub audit log sync
Cerbos PDP v0.57.0 adds a has operator to query plans so attribute presence checks reach your data layer, keeps large policy stores serving requests during full reloads, and cuts CPU, memory and disk use in Cerbos Hub audit log sync. Includes upgrade notes for query plan handlers.
Migrating from Oso to Cerbos
A practical guide to migrating from Oso Cloud or the deprecated oso library to Cerbos. Covers the Polar to Cerbos concept mapping, a worked translation with passing tests, moving facts to request attributes or Cerbos Synapse, list filtering with query plans, and proving parity before cutover.
How we use Cerbos inside Cerbos: Authorizing MCP tool calls
A real internal MCP server authorization setup, from the team that builds Cerbos. See how we give every tool call a named person, separate the person from the workload acting for them, gate warehouse queries and web access in policy, and ship policy changes through Cerbos Hub without redeploying.
AI coding agent authorization should not depend on who runs it
Coding agent permissions set by an approval prompt belong to one developer, on one machine, until someone turns the prompts off. Covers AI coding agent authorization decided centrally instead, what the COAZ draft formalizes, shell escapes a hook never sees, and the missing approval path.
What is AIAM? AI identity and access management explained
AIAM is IAM for AI agents. What it covers, why IAM built for humans breaks for agents, and why identity is the input and authorization is the enforcement.
Cerbos vs Oso
Comparing Cerbos and Oso? This guide covers where authorization data lives, where decisions run, policy language, RBAC, ABAC and relationship handling, list filtering, audit evidence and pricing, with an honest view of when Oso Cloud still fits and when Cerbos is the better choice.
Best IAM solutions for enterprises in 2026
The best IAM solutions for enterprises, broken down by domain. Access management, identity governance, privileged access, machine identity, and authorization, with the notable vendors in each and how to choose, including the fine-grained authorization layer most enterprise identity programs leave hardcoded.
Who owns authorization in a large engineering organization?
A guide to authorization governance across teams. Covers Conway's law and IAM silos, the incident and cloud-cost price of an unowned decision, the layered ownership split the analyst frameworks converge on, and how to start - a layer-by-layer template for deciding who owns what.
Cerbos PDP v0.56.0: Rule table observability, and Cerbos Hub audit log targeting
Cerbos PDP v0.56.0 makes store reloads confirm that policies compiled, adds a rule table refresh metric and Cerbos Hub audit log targeting, and tightens policy validation and matching.
ZITADEL alternatives
ZITADEL alternatives compared by the reason you are leaving, from the AGPL license and free tier limits to operations and tenancy fit. Covers Keycloak, Authentik, Authelia, Ory, and managed options, and how to tell whether permissions, not the identity provider, are the layer that is failing
Cerbos included in the KuppingerCole Leadership Compass on Policy Based Access Management
Cerbos is included as a vendor in the KuppingerCole Leadership Compass on Policy Based Access Management, July 2025\. A short read on what sends teams to policy based access management, the two questions worth comparing vendors on, and how to test the model with one of your own access rules.
Hand the application a query filter, not a per row authorization decision
Per record authorization breaks when an application renders a list. This guide covers asking the policy engine what a user can see, turning a query plan into a database predicate, where AuthZEN search endpoints fit, and why translating to SQL, ORM or vector filters belongs in one place.
Read authorization attributes from the database, not a copy
Authorization attributes like plan tier, team and clearance already live in a database. How Cerbos Synapse fetches them at decision time with a SQL data source and a Starlark proxy extension, how to set cache TTL per attribute, and how checks fail closed when the database is unreachable.
Gluu vs Keycloak
A current comparison of Gluu and Keycloak for identity teams, covering the Janssen Project and Flex split, Keycloak's CNCF position, and where each project's authorization engine runs out of room.
Kafka topic authorization belongs in your policy set, not in a per cluster ACL list
Kafka ACLs accumulate per cluster. This guide covers how Kafka's pluggable authorizer hands topic access decisions to an external policy engine, how ACL bindings map onto resource policies, caching and fail closed tradeoffs on the broker hot path, and what moves topic access into one audited policy set.
Cerbos named a Sample Vendor for AuthZEN in the Gartner® Hype Cycle™ for Digital Identity, 2026
The Gartner Hype Cycle for Digital Identity, 2026 includes AuthZEN as a category, with Cerbos named as a Sample Vendor. We cover what the OpenID AuthZEN standard does, why interoperable authorization matters as AI agents spread, and where Cerbos fits.
Rich Authorization Requests (RAR) for agent tokens
OAuth scopes can say read the profile, not transfer 45 euros to this merchant. Here is how Rich Authorization Requests express precise, per-hop grants for AI agents.
Recommended content
Mapping business requirements to authorization policy
eBook: Zero Trust for AI, securing MCP servers
Experiment, learn, and prototype with Cerbos Playground
eBook: How to adopt externalized authorization
Framework for evaluating authorization providers and solutions
