Cerbos

Stateless self-hosted policy decision point for application authorization over gRPC and REST.

Provider: default
Kind: Policy engine
Category: Operations
Official docs: https://docs.cerbos.dev/cerbos/latest/policies/resource_policies.html

Properties · 5 set by this component

property	type	values	required	kind default	this component
accessModel · component property	enum	rbac \| abac \| rebac \| pbac	no	rbac	inherited
api · component property	enum	grpc \| rest	no	grpc	inherited
effect	enum	audit \| deny \| modify \| deploy-if-not-exists	no	—	▸ deny
enforcementMode	enum	enforced \| disabled	no	—	▸ enforced
managed	boolean	—	no	false	▸ false
policyCount	integer	—	no	—	inherited
policyStore · component property	enum	disk \| git \| blob \| database \| hub	no	disk	inherited
remediation	boolean	—	no	false	▸ false
scope	enum	resource \| group \| account \| organization	no	—	▸ resource

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "cerbos", component: "cerbos" }

Other Policy engine products · 56

Cloud Configalibaba-cloud-configalibabacloudpolicy-engine Data Security Centeralibaba-data-security-centeralibabacloudpolicy-engine Amazon CodeGuru Revieweraws-codeguru-reviewerawspolicy-engine AWS Configaws-configawspolicy-engine AWS Control Toweraws-control-towerawspolicy-engine IAM Access Analyzeraws-iam-access-analyzerawspolicy-engine AWS Lake Formationaws-lake-formationawspolicy-engine AWS License Manageraws-license-managerawspolicy-engine AWS Organizationsaws-organizationsawspolicy-engine AWS Resource Access Manageraws-ramawspolicy-engine Amazon Verified Permissionsaws-verified-permissionsawspolicy-engine Microsoft Entra Conditional Accessazure-conditional-accessazurepolicy-engine Azure Policyazure-policyazurepolicy-engine Microsoft Entra Privileged Identity Managementazure-privileged-identity-managementazurepolicy-engine Cloudflare Data Loss Preventioncloudflare-dlpcloudflarepolicy-engine CalypsoAIcalypsoaipolicy-engine OPA Gatekeepergatekeeperpolicy-engine Guardrails AIguardrails-aipolicy-engine HiddenLayer AI Security Platformhiddenlayerpolicy-engine KubeArmorkubearmorpolicy-engine Kubewardenkubewardenpolicy-engine Kyvernokyvernopolicy-engine Lakera Guardlakera-guardpolicy-engine LLM Guardllm-guardpolicy-engine NeMo Guardrailsnemo-guardrailspolicy-engine Open Policy Agentopapolicy-engine Permit.iopermit-iopolicy-engine Generic policy enginepolicy-enginepolicy-engine Prompt Securityprompt-securitypolicy-engine Protect AIprotect-aipolicy-engine Rebuffrebuffpolicy-engine Robust Intelligencerobust-intelligencepolicy-engine SonarQube Serversonarqubepolicy-engine DigitalOcean CSPMdigitalocean-cspmdigitaloceanpolicy-engine Access Context Managergoogle-access-context-managergcppolicy-engine Assured Workloadsgoogle-assured-workloadsgcppolicy-engine Binary Authorizationgoogle-binary-authorizationgcppolicy-engine Identity and Access Managementgoogle-cloud-iamgcppolicy-engine Firebase App Checkgoogle-firebase-app-checkgcppolicy-engine Model Armorgoogle-model-armorgcppolicy-engine

and 16 more → Policy engine page

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Cerbos: stateless self-hosted policy decision point for application authorization.
3# "Cerbos Policy Decision Point": open source, exposes REST and gRPC, RBAC with ABAC conditions.
4# "Resource policies": anything not matched by an ALLOW rule is implicitly denied.
5schemaVersion: "1"
6type: "component"
7id: "cerbos"
8kind: "policy-engine"
9provider: "default"
10docs: "https://docs.cerbos.dev/cerbos/latest/policies/resource_policies.html"
11defaults:
12  effect: "deny"
13  enforcementMode: "enforced"
14  scope: "resource"
15  remediation: false
16  managed: false
17properties:
18  accessModel:
19    type: "enum"
20    values: ["rbac", "abac", "rebac", "pbac"]
21    default: "rbac"
22  api:
23    type: "enum"
24    values: ["grpc", "rest"]
25    default: "grpc"
26  policyStore:
27    type: "enum"
28    values: ["disk", "git", "blob", "database", "hub"]
29    default: "disk"

The same page as markdown, for an agent: /catalogue/components/cerbos.md