Authorize in any language, any framework, any identity
Seamlessly integrate Cerbos into your existing ecosystem.
Agent2Agent ProtocolPolicy-driven authorization for inter-agent communication via the Agent2Agent protocol
AI
Agent GatewayPolicy-driven authorization for MCP, A2A, and LLM traffic through Agent Gateway
AI
Amazon EC2Standalone binary or container PDP on EC2 with full instance control
Deployment
Amazon Elastic Container ServiceStateless PDP container running as an ECS task or Fargate sidecar
Deployment
Amazon Elastic Kubernetes ServiceHelm-managed Cerbos on EKS with IRSA and Fargate support
Deployment
Amazon Elastic BeanstalkMulti-container Cerbos sidecar that auto-scales with Beanstalk instances
Deployment
AWS LambdaEmbedded in-process PDP for serverless authorization with no network hop
Deployment
Aperture by TailscaleZero Trust authorization for AI agents routed through Aperture by Tailscale
AI
ASP.NETAuthorize ASP.NET controllers and endpoints via the Cerbos .NET SDK
Frameworks
Azure Kubernetes ServiceCerbos on AKS with workload identity and Helm-based lifecycle management
Deployment
Azure Container AppsManaged container PDP on Azure Container Apps with scaling and revision control
Deployment
Azure Virtual MachineBinary or container PDP on Azure VMs with Scale Set auto-scaling
Deployment
ApigeeCerbos policy checks via Apigee service callout policies on API proxy requests
API gateways
Auth0Map Auth0 Actions, Organizations, and roles to Cerbos policy inputs
Identity providers
AuthentikAuthentik property mappings shape token claims for Cerbos policy inputs
Identity providers
AWS API GatewayLambda authorizer that evaluates Cerbos policies for API Gateway
API gateways
AWS App MeshCerbos authorization via Envoy ext_authz within AWS App Mesh sidecars
Authorization extensions
AWS CognitoCognito user pool groups and custom attributes as Cerbos policy inputs
Identity providers
Azure API ManagementCerbos policy evaluation via Azure API Management inbound policies on each request
API gateways
Azure DevOps PipelinesPush Cerbos policies to Cerbos Hub on every merge via Azure DevOps Pipelines
CI/CD
Bitbucket PipelinesPush Cerbos policies to Cerbos Hub on every merge via Bitbucket Pipelines
CI/CD
BuildkitePush Cerbos policies to Cerbos Hub on every merge via Buildkite
CI/CD
CircleCIPush Cerbos policies to Cerbos Hub on every merge via CircleCI
CI/CD
ClerkClerk session claims and Organizations drive Cerbos policy evaluation
Identity providers
CloudflareCerbos policy checks within Cloudflare Workers at the network edge
API gateways
AWS CognitoPull Cognito custom attributes and groups into the PDP at decision time
Context sources
Consul ConnectCerbos authorization via Envoy ext_authz within Consul Connect sidecars
Authorization extensions
ContourCerbos authorization via Envoy ext_authz at the Contour ingress controller
Authorization extensionsAPI gateways
Curity Identity ServerCurity token procedure claims as principal attributes in Cerbos
Identity providers
Data Source ExtensionsReusable data connectors with built-in caching for the Cerbos authorization pipeline
Context sources
DescopeDescope JWT claims, tenant data, and role assignments feed into Cerbos policy evaluation
Identity providers
Duende IdentityServerDuende IdentityServer claims and scopes evaluated by Cerbos in .NET apps
Identity providers
Emissary-Ingress (Ambassador)Cerbos authorization via Envoy ext_authz at the Emissary-Ingress API gateway
Authorization extensionsAPI gateways
EmpowerIDEmpowerID governance roles and delegated access in Cerbos policies
Identity providers
Microsoft Entra IDResolve Entra ID security groups and directory roles for policy evaluation
Context sources
Envoy External AuthorizationCerbos as a native ext_authz gRPC service for Envoy proxies
Authorization extensionsAPI gateways
External APICall external services to fetch context data for policy evaluation
Context sources
FirebaseFirebase custom claims feed into Cerbos for resource-level decisions
Identity providers
FusionAuthFusionAuth per-application roles and custom data fields in Cerbos policies
Identity providers
GitHub ActionsPush Cerbos policies to Cerbos Hub on every merge via GitHub Actions
CI/CD
GitLab CI/CDPush Cerbos policies to Cerbos Hub on every merge via GitLab CI/CD
CI/CD
Gloo GatewayCerbos authorization via Envoy ext_authz at the Gloo Gateway edge
Authorization extensionsAPI gateways
Gluu ServerGluu LDAP-backed groups and OIDC claims evaluated by Cerbos policies
Identity providers
Google Identity PlatformGoogle Identity Platform custom claims and tenant context feed into Cerbos policy evaluation
Identity providers
Gravitee API GatewayEvaluate Cerbos policies on every request at the Gravitee API Gateway edge
API gateways
Istio Service MeshExternal authorizer for service-to-service calls in Istio meshes
Authorization extensions
JumpCloudJumpCloud directory groups and OIDC claims drive Cerbos policy evaluation
Identity providers
JSON Web TokensCerbos natively decodes JWTs and maps claims to policy attributes
Identity providers
Kubernetes Admission ControlValidating webhook that enforces Cerbos policies on cluster resources
Authorization extensions
Apache KafkaPluggable authorizer for Kafka topic, consumer group, and cluster ops
Authorization extensionsData filtering
KeycloakPull realm roles, client roles, and group paths from Keycloak into policies
Context sources
KeycloakKeycloak realm roles, client roles, and group hierarchies in Cerbos policies
Identity providers
KindeKinde organizations and feature flags as inputs to Cerbos policies
Identity providers
Kong GatewayEvaluate Cerbos policies on every request at the Kong gateway edge
API gateways
Broadcom Layer7 API GatewayCerbos policy enforcement at the Broadcom Layer7 gateway edge
API gateways
LDAPQuery any LDAPv3 directory for user attributes and group memberships
Context sourcesIdentity providers
LDAPLDAP group DNs and organizational units as Cerbos principal attributes
Identity providers
LitestreamRead Litestream-replicated SQLite databases as a policy data source
Context sources
MagicMagic DID tokens and wallet addresses as Cerbos principal attributes
Identity providers
Microsoft Entra IDEntra ID security groups and app roles evaluated by Cerbos policies
Identity providers
MongooseApply Cerbos query plans as MongoDB filter predicates via Mongoose
Data filtering
MySQLBuilt-in data source that queries MySQL tables at decision time
Context sources
Neo4jTraverse Neo4j relationship graphs to resolve authorization context
Context sources
NGINXCerbos policy checks via the NGINX auth_request module at the reverse proxy edge
API gateways
OktaFetch Okta profiles and group memberships into policy evaluations
Context sources
OktaOkta groups and Universal Directory attributes as Cerbos policy inputs
Identity providers
OneLoginOneLogin roles and group memberships from OIDC tokens drive Cerbos policy evaluation
Identity providers
OryOry Kratos identity traits from JSON schemas feed Cerbos policies
Identity providers
Ping IdentityPingOne populations and PingFederate attributes in Cerbos policies
Identity providers
PostgreSQLBuilt-in data source that queries PostgreSQL at decision time
Context sources
PrismaInject Cerbos query plans as Prisma where-clause filters on any model
Data filtering
Proxy ExtensionsTransparent request enrichment that fetches context from external systems before policy evaluation
Context sources
Route ExtensionsProtocol translation layer that lets any infrastructure component delegate authorization to Cerbos
Authorization extensions
SecureAuthSecureAuth risk signals and identity attributes in Cerbos policy checks
Identity providers
SQLAlchemyAppend Cerbos query plans to SQLAlchemy select statements as filters
Data filtering
SQLiteEmbedded SQLite data source for local policy context lookups
Context sources
StytchStytch B2B organization memberships and roles in Cerbos policy checks
Identity providers
SupabaseSupabase app_metadata and JWT claims as policy inputs alongside RLS
Identity providers
SuperTokensSelf-hosted authorization using SuperTokens session claims in Cerbos
Identity providers
Thales IdentityThales SafeNet identity attributes drive resource-level Cerbos policies
Identity providers
Traefik ProxyCerbos policy evaluation via Traefik's ForwardAuth middleware on each request
API gateways
Apache TrinoCatalog, schema, and column-level access control via Apache Trino's authorization hook
Authorization extensions
Tyk GatewayCerbos policy evaluation as a Tyk gateway middleware plugin
API gateways
WorkOSWorkOS Directory Sync groups and Organizations in Cerbos B2B policies
Identity providers
WSO2 API ManagerAttach Cerbos policy checks to WSO2 API Manager request flows
API gateways
ZitadelZitadel project roles and organization grants as Cerbos policy inputs
Identity providers
Zuplo API GatewayInline Cerbos authorization checks within Zuplo request pipelines
API gateways
ChromaDBTranslate Cerbos query plans into ChromaDB metadata filters
Data filteringAI
Claude Agent SDKGate Claude agent tool calls and data access through Cerbos policies
AI
Claude CodeCentralized policy enforcement and audit logging for Claude Code agent tool calls
AI
Cloudflare WorkersServerless authorization at the network edge via Cerbos inside Cloudflare Workers
Deployment
ConvexConvert Cerbos query plans into native Convex filter expressions
Data filtering
CrewAIPer-agent and per-tool authorization for CrewAI multi-agent workflows through Cerbos policies
AI
DigitalOceanContainer or binary PDP on DigitalOcean App Platform, Droplets, or Managed Kubernetes
Deployment
DjangoAuthorize Django views and middleware via the Cerbos Python SDK
Frameworks
DockerOfficial multi-arch container image for local dev and production
Deployment
.NETNuGet package with async/await and strongly typed Cerbos models
SDKs
Drizzle ORMMap Cerbos query plans to Drizzle ORM where-clause conditions
Data filtering
ElasticsearchEmit Cerbos query plans as Elasticsearch bool query filters
Data filtering
ExpressEnforce access control per route via Express middleware hooks
Frameworks
FastAPIInject Cerbos checks as FastAPI dependencies in endpoint signatures
Frameworks
FastMCPDrop-in Cerbos middleware for FastMCP tool and resource authorization
AI
FlaskAuthorize Flask routes via decorators or before-request hooks with Cerbos
Frameworks
Fly.ioStateless PDP instances placed close to users across Fly.io regions
Deployment
GinCerbos authorization wired into the Gin middleware chain
Frameworks
GogRPC-native SDK with strongly typed checks and context.Context support
SDKs
Google Agent Development KitGate Google ADK agent tool calls and data access through Cerbos policies
AI
Google Cloud Compute EngineCerbos binary or container on Compute Engine with Managed Instance Groups
Deployment
Google Kubernetes EngineHelm-managed Cerbos on GKE with Workload Identity and Autopilot support
Deployment
Google Cloud RunServerless container PDP on Cloud Run with automatic scaling and managed infrastructure
Deployment
GorillaCerbos authorization wired into the Gorilla Mux middleware chain
Frameworks
GraphQLPer-field and per-resolver access control for GraphQL schemas
Frameworks
HelmOfficial Helm chart with production-ready defaults for the Cerbos PDP
Deployment
HomebrewOne-command install of the Cerbos binary on macOS or Linux
Deployment
HonoAuthorize Hono routes and middleware via the Cerbos JavaScript SDK
Frameworks
JavaMaven Central SDK with blocking and CompletableFuture Cerbos clients
SDKs
JavaScriptAsync SDK for Node.js, edge runtimes, and browsers with TypeScript types
SDKs
KubernetesRun the PDP as a Deployment, DaemonSet, or sidecar in any K8s cluster
Deployment
LangChainGate LangChain and LangGraph tool calls through Cerbos policies
AI
LangGraphPer-node and per-tool authorization for LangGraph multi-step agent workflows
AI
LaravelCerbos policies behind Laravel Gate::allows() and @can directives
SDKs
LlamaIndexEnforce authorization on LlamaIndex agent tool calls and data connector access through Cerbos policies
AI
Model Context ProtocolPer-tool and per-resource authorization for Model Context Protocol servers
AI
NestJSCerbos checks via NestJS guards, decorators, and injectable modules
Frameworks
NextJSAuthorize middleware, server components, and API routes in Next.js
Frameworks
HashiCorp NomadContainer PDP orchestrated by Nomad with Consul service discovery and health checks
Deployment
NuxtAccess control in the Nitro server layer for Nuxt routes and APIs
Frameworks
OpenAI Agents SDKGate OpenAI Agents SDK tool invocations through Cerbos policy evaluation
AI
PHPPSR-compatible Composer package for Cerbos authorization in PHP
SDKs
Pythonpip-installable SDK for sync and async Cerbos authorization in Python
SDKs
PineconeCerbos policy decisions as Pinecone metadata filters in LangGraph RAG
AIData filtering
RAG (Retrieval-Augmented Generation)Enforce document-level access control on vector store retrieval
AIData filtering
Ruby on RailsAuthorize Rails controllers and actions via the Cerbos Ruby SDK
Frameworks
RailwayContainer PDP deployed to Railway with managed networking and automatic restarts
Deployment
React RouterGate data loading and mutations in React Router loaders and actions
Frameworks
RenderContainer PDP running as a Render web service with managed TLS and health checks
Deployment
RubyIdiomatic Ruby gem for authorization checks against the Cerbos PDP
SDKs
RustAsync, type-safe Cerbos client built on tonic and tokio
SDKs
Semantic KernelGate Semantic Kernel plugin and function invocations through Cerbos policy evaluation
AI
SPIFFESPIFFE IDs authorize service-to-service calls through Cerbos policies
Identity providers
Spring BootWire Cerbos into Spring Boot with annotations and bean injection
Frameworks
Spring Data JPATurn Cerbos query plans into JPA Specification predicates for Spring
Data filtering
SvelteKitAuthorize load functions, form actions, and hooks in SvelteKit
Frameworks
SystemdNative binary managed by systemd with journal logging and auto-restarts
Deployment
UCAST (Universal Conditions AST)Bridge Cerbos query plans to any data layer via the UCAST AST format
Data filtering
Vercel AI SDKGate AI tool invocations in Vercel AI SDK applications through Cerbos policy evaluation
AI
VueJSServer-evaluated permissions surfaced to Vue.js route guards and views
Frameworks
Trusted by hundreds of companies
