Cerbos Authorization Management Platform

Documentation

Overview

Painless access control for your software.

Quickstart

• Quickstart

What is Cerbos?

• What is Cerbos?

The Cerbos Admin API

• The Cerbos Admin API

The Cerbos API

• The Cerbos API

API Reference

• API reference

Command Line Interfaces

• cerbos
• cerbosctl
• Cerbos CLI

Configuration Blocks

• Audit block
• AuxData block
• Engine block
• Configuration
• Observability
• Schema block
• Server block
• Storage block
• Telemetry
• Tracing block

Deployment

• Deploy Cerbos to Cloud platforms
• Cerbos deployment patterns
• Deploy Cerbos as DaemonSet
• Deploy Cerbos as a service
• Deploy Cerbos as a sidecar
• Deploy Cerbos to Serverless/FaaS environments
• Deploy Cerbos as a systemd service

Engineering Insights

• Why we built Cerbos this way
• Why Cerbos runs as a separate process

Policy Authoring

• Glossary of Cerbos terms
• Policy authoring
• Best practices and recipes
• Validating and testing policies
• Conditions
• Debugging authorization decisions
• Derived roles
• How Cerbos evaluates requests
• Cerbos policies
• Outputs
• Principal policies
• Resource policies
• Role policies
• Schemas
• Scope Permissions
• Scoped policies
• Variables and constants

Recipes

• Field-level and column-level security
• Filtering resources by permission
• Modeling hierarchies and multi-tenancy
• Working with JWT claims in policies
• Integrating permission checks into your user interface

Installation

• Install from binary
• Run from container
• Install from Helm chart

Tutorials

• Tutorial
• Running locally
• Resource definition
• Calling Cerbos
• Testing policies
• Adding conditions
• Derived roles
• Principal policies
• Attribute schema
• Integrating Cerbos
• Tutorial: Writing policies for a simple photo-sharing service

Adapters

• Convex adapter
• Drizzle adapter
• Query plan adapters
• LangChain / ChromaDB adapter
• Mongoose adapter
• Prisma adapter
• SQLAlchemy adapter

AI Systems

• Implementing authorization in RAG-based AI systems

Authentication Tutorials

• Tutorial: Using Cerbos with Auth0
• Tutorial: Using Cerbos with AWS Cognito
• Tutorial: Using Cerbos with FusionAuth
• Tutorial: Using Cerbos with JWT
• Tutorial: Using Cerbos with Magic
• Tutorial: Using Cerbos with Okta

Administration

• Administration
• Audit log collection
• Concepts
• Service Policy Decision Points
• Embedded Policy Decision Points
• Deployments
• Getting started
• Cerbos Hub
• Insights
• Aperture by Tailscale
• On-premises deployment
• Collaborative policy playgrounds

Policy Stores

• Policy stores: CLI upload (binary)
• Policy stores: CLI upload (Container)
• Policy stores: CLI upload (Homebrew)
• Policy stores: CLI upload (npx)
• Cerbos Hub GitHub Integration
• Policy stores: .NET SDK
• Policy stores: Go SDK
• Policy stores: Java SDK
• Policy stores: JavaScript @cerbos/hub SDK
• Policy stores: PHP SDK
• Policy stores: Python SDK
• Policy stores: Rust SDK
• Policy stores: Browser Upload
• Policy stores

Release Notes

• Release notes
• Reliability

Synapse

• Cerbos Synapse
• Troubleshooting
• Usage dashboard
• User management
• Cerbos Synapse

Synapse Configuration

• Quick Start
• Connecting Synapse to Cerbos Hub
• Observability
• Configuration
• Run as a Tailscale service

Extensions

• Building custom Synapse extensions
• Data sources
• Envoy extension
• Extensions
• Proxy extensions
• Route extensions
• Developing Starlark extensions
• Testing custom extensions
• Extension URLs
• Developing Webassembly extensions
• Build a WASM extension in Go
• Build a WASM extension in TypeScript

Containerization

• Running Synapse in a container
• Installing Synapse using the Helm chart

Use Cases

• Guardrails for Aperture by Tailscale
• Securing Claude Code with Synapse