Skip to content

Compare

Permio vs Cerbos

Cerbos evaluates YAML policies against the principal and resource attributes your app sends with each request. Permio stores who has which role on which resource, so your app sends only IDs.

Facts about Cerbos as of October 2026, from its official site and docs (sources below). Corrections welcome.

What Cerbos is

Cerbos describes itself as “an authorization management platform for applications, APIs, AI agents, MCP servers, services, and workloads”.[1] Its policy decision point (PDP) is open source under Apache 2.0, stateless, and designed to run anywhere: as a Kubernetes service or sidecar, serverless, under systemd or at the edge.[1][2]

Policies are human-readable YAML (resource, principal and derived-role policies) with conditions written in CEL over request.principal.attr and request.resource.attr.[3][4] Cerbos Hub is a cloud-hosted control plane that adds policy CI/CD, playgrounds and an embedded PDP, while PDPs still run in your environment.[2][5]

What Permio is

Permio is a hosted permissions API. Resources are paths such as /projects/123/docs/9; you grant roles (bundles of permissions like document.read) to principals or groups on a path, and the grant covers everything below it. Your backend asks “can this principal do this here?” and gets allowed or denied. It works alongside whatever login you use. We’re early: the TypeScript SDK is public on npm, and paid pricing isn’t published yet.

How the models differ

  • Stateless vs stored. Cerbos decides from the policies plus the metadata in each request, so your app loads and sends the facts (owner, department, roles) every time.[3] Permio stores grants; a check sends a principal ID, a resource path and a permission.
  • Rules vs grants. Cerbos suits rules over attributes, such as “managers can approve expenses under a limit in their region”.[4] Permio has no attribute conditions: access comes from roles granted on resources, inherited down the path, directly or through groups.
  • Where it runs. Cerbos PDPs run next to your services for local decisions.[1][6] Permio is a hosted API your backend calls over the network.
  • List filtering. Cerbos PlanResources returns a query plan you translate into a database filter, with adapters for Prisma and SQLAlchemy.[2][7] Permio’s listAccess returns path scopes; toPrefixes() or toRegExp() turn them into a filter.

At a glance

Permio and Cerbos compared, as of October 2026
PermioCerbos
ModelRoles and permissions granted on hierarchical resource paths (e.g. /projects/123), inherited by everything below; groups; _ matches one segmentPolicy-as-code YAML (resource, principal and derived-role policies) with CEL conditions; RBAC and ABAC[3][4]
StateGrants are stored in Permio; a check sends only the principal ID, resource path and permissionStateless PDP: principal and resource attributes are sent with each request[1][3]
HostingManaged API hosted by Permio (Google Cloud, London). No self-hosted option todaySelf-hosted PDP; optional Cerbos Hub cloud control plane[2][5]
Open sourceTypeScript SDK (MIT) and Rust client are open source; the service itself is notPDP is Apache 2.0[2]
List filteringlistAccess returns scopes you turn into a SQL, Prisma or MongoDB filterPlanResources query plans; Prisma and SQLAlchemy adapters[2][7]
SDKsTypeScript on npm; REST (JSON) and gRPC / gRPC-web for any language; Rust client. Go and Python comingGo, Java, JavaScript, .NET, Laravel, PHP, Python, Ruby, Rust[7]
ToolingDashboard with an Access tester (why a check was allowed) and an audit log of changesPolicy tests with cerbos compile, playgrounds, Hub audit logs[5][8]
PricingFree to start, no credit card. Paid plans not yet publishedOpen source is free; Hub plans are published, including a free tier[5]

When to choose which

Choose Cerbos if

  • Your rules depend on attributes and context (amounts, time, department, request data) more than on stored grants.
  • You want policies in Git with built-in tests and CI, reviewed like code.[8]
  • You need decisions inside your own infrastructure (sidecar, edge or air-gapped), or SDKs for Go, Java, .NET, PHP, Python, Ruby or Rust.[6][7]

Choose Permio if

  • Access is mostly “who was granted what, where”: sharing, workspaces, teams and per-object grants that change at runtime.
  • You don’t want to load and pass ownership and role attributes on every check, or deploy and operate PDPs.
  • You want a dashboard where non-engineers can grant access and see why a check passed.

Want to see whether Permio’s model fits your app? The quickstart takes a few minutes, and it’s free to start.

Start free Read the docs

Sources

Fetched October 2026.

  1. Cerbos documentation: https://docs.cerbos.dev/cerbos/latest/
  2. Cerbos on GitHub: https://github.com/cerbos/cerbos
  3. Cerbos: Policies: https://docs.cerbos.dev/cerbos/latest/policies/index.html
  4. Cerbos: Conditions: https://docs.cerbos.dev/cerbos/latest/policies/conditions.html
  5. Cerbos pricing: https://www.cerbos.dev/pricing
  6. Cerbos homepage: https://www.cerbos.dev/
  7. Cerbos: API: https://docs.cerbos.dev/cerbos/latest/api/index.html
  8. Cerbos: Compile and test policies: https://docs.cerbos.dev/cerbos/latest/policies/compile.html

Other comparisons