Cerbos PDP is a stateless, open-source policy decision point server that evaluates authorization requests and returns access decisions via HTTP (port 3592) and gRPC (port 3593) interfaces. It processes six policy types—derived roles, resource policies, principal policies, role policies, exported variables, and exported constants—to determine whether requested actions on resources are permitted, returning allow, deny, or conditional outcomes based on principal and resource attributes, conditions, derived roles, policy constants, and output expressions. The system supports RBAC, ABAC, and other context-aware access control models for both human and non-human identities, including row-level authorization through a query-plan API that generates abstract syntax trees for translation into ORM filters. Policies are defined in human-readable YAML, loaded from mounted directories with automatic change detection, and can be stored in Git, disk, cloud, or database backends with schema validation reporting errors directly in evaluation results.
The PDP supports horizontal scaling across multiple deployment patterns and environments including self-hosted, cloud, on-premise, air-gapped, serverless functions, sidecar configurations, browsers, embedded devices, and edge locations. It can be deployed as a central shared service, as a sidecar attached to application pods, or as a DaemonSet with one instance per cluster node, with each model offering different trade-offs in latency, resource efficiency, scaling, and availability. Integration is facilitated through an API-first approach with native SDKs and language-specific client libraries for JavaScript, Python, Go, Ruby, PHP, and other languages, including a JavaScript SDK with automatic bundle updates for embedded deployments. The system provides full auditing with real-time change logs, integrates with CI/CD pipelines and IDE tooling, and supports batch authorization checks, time-based functions with configurable time zones, and audit logging filtered by PDP instance ID and policy source. TLS is recommended for communication between applications and the PDP.
