cerbos

What it is and what it does

Cerbos is a Python SDK that connects your application to a Cerbos authorization service—a separate, language-agnostic policy engine that evaluates access control decisions. Instead of embedding authorization logic in your code, you define context-aware policies in Cerbos and query them via this client. The SDK provides two transport options (gRPC recommended for new projects, HTTP for backwards compatibility), both with sync and async support, plus an Admin API for policy management.

The library handles the protocol details: it serializes principals (users with roles and attributes), resources (the objects being accessed), and actions into protobuf messages, sends them to the Cerbos service, and returns whether an action is allowed or a query plan for filtering resources. It also supports Cerbos Hub for managed policy storage, Unix domain sockets, TLS configuration, and custom gRPC channel options.

Use it for:

• Check if a user can perform an action on a resource before executing application logic.
• Generate query plans to filter database results based on user permissions without fetching all records.
• Manage authorization policies centrally in Cerbos Hub and sync them via the Admin API.
• Build multi-tenant applications where permissions depend on department, geography, or team attributes.
• Implement async authorization checks in high-concurrency services using AsyncCerbosClient.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Python client library for querying and managing authorization policies in a Cerbos authorization service, supporting both gRPC and HTTP protocols with sync and async modes.

Yes, if you are already running a Cerbos authorization service or planning to adopt one. The SDK is actively maintained, has no known vulnerabilities, and low install friction. It is purpose-built for Cerbos integration and not a general-purpose authorization library—install it only when Cerbos is your chosen policy engine.

Install

cerbos on PyPI

pip install cerbos

uv add cerbos

poetry add cerbos

Installing cerbos

Before you install

Low friction install with a pure-Python wheel. Active maintenance with a release 1 day old. Requires Python 3.10 or later and 12 runtime dependencies including gRPC, protobuf, and HTTP tooling.

License in practice

Apache-2.0 permissive license allows commercial and private use with minimal restrictions; suitable for most projects.

Quickstart

pip install cerbos

from cerbos.sdk.grpc.client import CerbosClient
from cerbos.engine.v1 import engine_pb2

principal = engine_pb2.Principal(id="john", roles={"employee"})
resource = engine_pb2.Resource(id="XX125", kind="leave_request")

with CerbosClient("localhost:3593", tls_verify=False) as c:
    if c.is_allowed("view", principal, resource):
        print("Access allowed")

Requires a running Cerbos authorization service accessible at the specified host and port; Python 3.10 or later.

Verify before relying

• Performance characteristics and latency impact of gRPC vs HTTP client modes under typical load.
• Completeness of async API coverage relative to sync client.
• Admin API feature parity and stability guarantees.

Package facts

Evidence: cerbos-0.16.0-py3-none-any.whl

Tags

More Libraries packages