Insights & News

Welcome to Cerbos Insights & News. Here, you’ll find company news, thought leadership, success stories and industry insights.

1. Understanding security and access control requirements of microservices environment
   Learn how you can implement robust security protocols and access control measures to ensure inter-services communicating is not compromised.](/content/blog/security-and-access-control-microservices/index.html)

2. Comparing User Permissions Strategies
   Microservices architectures are the dominant force in today’s software engineering realm. This infrastructure approach—despite its multiple benefits—has created quite a tangled management web. IBM has corroborated this, sharing that applica...](/content/blog/comparing-microservice-permissions-strategies/index.html)

3. The importance of stateless architecture in authorization systems
   Going stateless might sound complicated, but it can actually simplify system deployment, maintenance, and integration. This article explores what stateless is, how it's implemented, and why it's so beneficial to real-world systems such as authorization services.](/content/blog/the-importance-of-stateless-architecture-in-authorization-systems/index.html)

4. Zero-Trust for microservices, a practical blueprint
   Learn how to implement a Zero-Trust security model for microservices. Discover how to secure service-to-service communication, manage workload identities, and enforce fine-grained authorization across distributed systems, AI agents, and APIs.](/content/blog/zero-trust-for-microservices/index.html)

5. Determining service boundaries and decomposing your monolith
   The first major hurdle when decomposing a monolith app is defining appropriate boundaries for each microservice. We’ll cover how to break down a monolithic app into smaller, independently deployable services that align with business capabilities.](/content/blog/determining-service-boundaries-and-decomposing-monolith/index.html)

6. How to secure microservices without creating a distributed nightmare
   How to secure microservices across five critical layers, from authentication and token propagation to authorization, API gateways, and Zero Trust. Covers common vulnerabilities during monolith-to-microservices migration, how Netflix secured their architecture, and how to enforce consistent access control across distributed services.](/content/blog/how-to-secure-microservices-without-creating-a-distributed-nightmare/index.html)

7. Authorization in microservices: Patterns, pitfalls, and how to scale it
   Authorization in microservices explained. Why it is harder than a monolith, where it gets enforced, the three patterns for handling authorization data, choosing RBAC or ABAC, service-to-service authorization, and the externalized policy decision point pattern that scales across services without scattered checks or redeploys.](/content/blog/tips-for-microservices-authorization/index.html)

8. Implement authorization and access control in an Express application
   Explore importance of roles and permissions in webapps and learn how to use Cerbos authorization to enforce RBAC for a sample LMS implemented in Express and Node.](/content/blog/implement-authorization-in-express/index.html)

9. RBAC vs ABAC - Which is better for your use case?
   A practical RBAC vs ABAC guide covering what each model is, the key differences, whether ABAC is more secure, role explosion, when to use RBAC or ABAC, and how to combine them in one set of policies instead of choosing between them.](/content/blog/rbac-vs-abac/index.html)

10. ABAC examples: Real attribute-based access control policies and use cases
    A practical guide to attribute-based access control with real ABAC examples and policy code. Covers the four attribute types, industry use cases, how to write your own ABAC policy, the trade-offs, and where ABAC is heading for Zero Trust and AI agents.](/content/blog/abac/index.html)

11. Enterprise access control in service-oriented architectures
    Choosing the right access control model for your enterprise isn't just a technical decision - it’s a business one. Explore the challenges of role explosion, the advantages of attribute-based access, and how a hybrid approach can simplify authorization while ensuring compliance and security.](/content/blog/enterprise-access-control/index.html)

12. How to add authorization to a Flask application
    Reliable authorization is vital if you hope to create a secure web app. Read this guide and learn how to implement authorization in a Flask application.](/content/blog/flask-authorization/index.html)

13. Ory vs SuperTokens for authentication
    Ory Hydra and SuperTokens solve different authentication problems. Compare OAuth2 and OIDC token infrastructure against fast product login and session handling, and see where Cerbos fits as the authorization layer after authentication.](/content/blog/ory-vs-supertokens/index.html)

14. What is fine-grained authorization?
    Fine-grained authorization explained. Learn how fine-grained access control uses attributes and conditions to decide access per resource and action, how it differs from coarse-grained control, the RBAC, ABAC and PBAC models behind it, real use cases, and how to implement it without building your own engine.](/content/blog/what-is-fine-grained-authorization/index.html)

15. The incident response workflow that decides how fast you recover
    A step-by-step incident response workflow for the authorization layer, from mapping a compromised identity's blast radius to proving containment held. Covers how centralized policy and decision logs compress each phase, what makes the workflow feasible in regulated and air-gapped environments, and how AI agents change the runbook.](/content/blog/incident-response-authorization-workflow/index.html)

16. You have Auth0. What authorization capabilities do you still need?
    Auth0 covers authentication, but authorization capabilities like resource-level ABAC, per-tenant policies, and decision audit logs sit outside its model. This guide covers where Auth0 RBAC and Auth0 FGA stop, five signals you need a dedicated authorization layer, and how to evaluate solutions and run a POC.](/content/blog/you-have-auth0-what-authorization-capabilities-do-you-still-need/index.html)

17. Agent skill for writing authorization policies in AWS Kiro
    AWS Kiro is spec-driven, which means the access model is captured properly before any YAML gets written. This guide walks through installing the Cerbos policy skill in Kiro, the spec-then-policy workflow, how the skill picks up AWS Cognito attributes, and how validation runs against the real Cerbos compiler.](/content/blog/agent-skill-for-writing-authorization-policies-in-aws-kiro/index.html)

18. Authentication vs Authorization
    Authentication vs authorization explained. AuthN verifies who a user is, AuthZ decides what they can do. This guide covers ID and access tokens, OAuth 2.0, OpenID Connect, SAML, SSO, RBAC and ABAC, the key differences between the two, and the mistakes teams make building them.](/content/blog/authentication-vs-authorization/index.html)

19. You have Okta. What authorization capabilities do you still need?
    You've standardized on Okta SSO for authentication. Here's where Okta falls short on authorization, and how to evaluate dedicated authorization solutions.](/content/blog/you-have-okta-what-authorization-capabilities-do-you-still-need/index.html)

20. Framework for evaluating authorization providers and solutions
    In this guide, we provide a framework for evaluating authorization providers and solutions, tailored to the priorities of enterprise decision-makers. We cover all the key criteria - from integration and performance to admin experience and compliance, and back them with data, industry research, and success metrics.](/content/blog/framework-evaluating-authorization-providers-solutions/index.html)