What authorization models and deployment options does Cerbos support?

Updated

Cerbos supports RBAC, ABAC, ReBAC, and PBAC out of the box, and it can be deployed in cloud, on-prem, or air-gapped environments. Its stateless architecture is designed to handle millions of authorization decisions per second across distributed systems and AI agents. If you need to centralize authorization logic without changing application code, Cerbos covers both the model and deployment side.

Authorization models supported

Cerbos describes its policy engine as supporting four common authorization models out of the box:

Model What it decides on Typical use
RBAC (Role-Based Access Control) The role assigned to an identity Standard employee or service-account permissions
ABAC (Attribute-Based Access Control) Attributes of the identity, resource, or context Contextual rules such as department, region, or resource state
ReBAC (Relationship-Based Access Control) Relationships between identities and resources Ownership, sharing, and hierarchy-based access
PBAC (Policy-Based Access Control) Centralized policy definitions Governing many resource types under one policy set

The platform positions these as a replacement for scattered if-statements: you define, approve, and update policies centrally, then call a single function from your application to get an authorization decision. According to the site, roles and permissions can be deployed without code changes, and authorization can be shipped in one sprint.

Deployment options

Cerbos lists three deployment environments:

  • Cloud — managed deployment for teams that don't want to run the authorization service themselves.
  • On-prem — self-hosted within your own infrastructure.
  • Air-gapped — isolated environments with no external network access, for high-security or regulated settings.

The architecture is stateless, which is what allows it to scale horizontally across distributed systems and AI agents. Cerbos claims it can handle millions of authorization decisions per second in this configuration.

What this means in practice

If you're evaluating Cerbos against your existing stack, the relevant questions are:

  1. Do you need more than roles? If your access rules depend on attributes, relationships, or centralized policy, Cerbos covers those models without you building a custom engine.
  2. Where must the decision run? Cloud, on-prem, and air-gapped are all listed, so regulated or isolated environments are in scope.
  3. How much traffic? The stateless design is aimed at high-volume, distributed authorization rather than a single monolithic app.

Cerbos also positions itself as filling the gap after authentication: your identity provider authenticates, your IGA provisions roles, and Cerbos controls what identities actually do at the resource level at runtime. That includes users, service accounts, non-human identities (NHIs), and AI agents.

Where to verify specifics

Pricing and plan details are not covered in the available page evidence, so check the Cerbos pricing page directly before assuming cost or licensing terms. For model-specific policy syntax and deployment configuration, the product documentation is the authoritative source.