cerbos-sqlalchemy
SQLAlchemy adapter for generating queries with Cerbos: an open core, language-agnostic, scalable authorization solution
Decision gist · record as of 2026-08-14
Yes. This is a well-maintained, low-friction adapter (pure Python, two dependencies, no vulnerabilities) that solves a real problem: pushing authorization enforcement into database queries rather than application code. It is actively developed, permissively licensed, and tested against a reference conformance suite. Install it if you use Cerbos and SQLAlchemy together and want to avoid loading unauthorized records into memory.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires a running Cerbos PDP server (typically at localhost:3592 or configured host); SQLAlchemy >= 1.4 and Cerbos > v0.16.
- Low friction: pure Python wheel with only two runtime dependencies (cerbos and sqlalchemy).
- Active maintenance with a recent release (11 days old) and no known vulnerabilities.
License · maintenance · safety
Apache-2.0 (permissive) — Apache-2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.
last release 2026-08-03 (11 days) · last repo commit 2026-08-14 · 21 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 128,627 downloads/mo, #11,701 on PyPI
Alternatives
Verify before relying
pip install cerbos-sqlalchemy
from cerbos.sdk.client import CerbosClient
from cerbos_sqlalchemy import get_query
from sqlalchemy.orm import declarative_base
Base = declarative_base()
class LeaveRequest(Base):
__tablename__ = "leave_request"
# ... columns ...
with CerbosClient(host="http://localhost:3592") as c:
plan = c.plan_resources("view", principal, resource_desc)
attr_map = {"request.resource.attr.department": LeaveRequest.department}
query = get_query(plan, LeaveRequest, attr_map)- Exact scope of CEL operator coverage beyond the 112 reference conformance actions listed.
- Performance characteristics when translating complex query plans with many nested conditions.
- Compatibility with SQLAlchemy 2.0 ORM features beyond the basic declarative patterns shown.
What it is and what it does
cerbos-sqlalchemy bridges Cerbos, an open-source authorization engine, and SQLAlchemy by translating Cerbos query plans (from its PlanResources API) into native SQLAlchemy Select queries. Instead of fetching all records and filtering in application code, this adapter pushes authorization logic down to the database layer, where the SQL WHERE clause enforces attribute-based access control rules.
The adapter handles logical operators, comparisons, field-to-field checks, string operations, timestamps, and hierarchy comparisons. It is tested against Cerbos PDP 0.54.0 with 112 reference conformance actions and supports both ORM entities and raw Table instances. Users can override default SQL operators for database-specific optimizations (e.g., PostgreSQL's `= ANY` instead of `IN`), and must ensure mapped columns use case-sensitive collation to prevent silent over-granting of access.
Use it for
- Enforce department-level access control on leave requests by converting Cerbos policies into WHERE clauses that filter authorized rows.
- Implement role-based filtering on multi-tenant data by translating principal attributes and resource policies into database queries.
- Optimize authorization checks on large datasets by pushing policy evaluation to the database query layer instead of loading in memory.
- Support complex attribute-based rules (e.g., geography, team, priority) by mapping Cerbos CEL expressions to portable SQL predicates.
- Override default SQL operators for database-specific idioms, such as using PostgreSQL's `= ANY` for collection membership instead of `IN`.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
This is a well-maintained, low-friction adapter (pure Python, two dependencies, no vulnerabilities) that solves a real problem: pushing authorization enforcement into database queries rather than application code. It is actively developed, permissively licensed, and tested against a reference conformance suite. Install it if you use Cerbos and SQLAlchemy together and want to avoid loading unauthorized records into memory.
Install
cerbos-sqlalchemy on PyPI
Before you install
Low friction: pure Python wheel with only two runtime dependencies (cerbos and sqlalchemy). Active maintenance with a recent release (11 days old) and no known vulnerabilities.
Requires a running Cerbos PDP server (typically at localhost:3592 or configured host); SQLAlchemy >= 1.4 and Cerbos > v0.16.
License in practice
Apache-2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.
Quickstart
pip install cerbos-sqlalchemy
from cerbos.sdk.client import CerbosClient
from cerbos_sqlalchemy import get_query
from sqlalchemy.orm import declarative_base
Base = declarative_base()
class LeaveRequest(Base):
__tablename__ = "leave_request"
# ... columns ...
with CerbosClient(host="http://localhost:3592") as c:
plan = c.plan_resources("view", principal, resource_desc)
attr_map = {"request.resource.attr.department": LeaveRequest.department}
query = get_query(plan, LeaveRequest, attr_map)Verify before relying
- Exact scope of CEL operator coverage beyond the 112 reference conformance actions listed.
- Performance characteristics when translating complex query plans with many nested conditions.
- Compatibility with SQLAlchemy 2.0 ORM features beyond the basic declarative patterns shown.
Package facts
| License | Apache-2.0 permissive |
| Python support | Supports the current Python release >=3.8 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagescerbossqlalchemy |
| Maintenance | Actively maintained 11 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 128,627 / month, #11,701 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaIntended Audience :: DevelopersTopic :: SecurityTopic :: Software Development :: Libraries |
Evidence: cerbos_sqlalchemy-0.4.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “cerbos sqlalchemy integration”
- cerbos-sqlalchemyConverts Cerbos authorization query plans into SQLAlchemy Select…
- cerbosPython client library for querying and managing authorization…
- pybigquerySQLAlchemy dialect for BigQuery that enables SQL queries against…
Give your agent the search over MCP, or paste the wish link into any chat.
More Libraries packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
Pluggy provides a plugin system that lets you define hook specifications and register implementations to be called in sequence, enabling extensible Python applications without tight coupling.
Install it if you're building an extensible application or framework.
Provides parsing, arithmetic, and recurrence rule computation for dates and times, with timezone support and iCalendar RFC compliance.
Install it if you need to parse flexible date strings, compute relative dates, handle timezones, or work with recurrence rules—it's the de facto choice for these tasks.
Six provides utility functions to write Python code that runs on both Python 2.7 and Python 3.3+, smoothing over language differences between the two versions.
pytest is a testing framework that lets you write test functions using plain assert statements and automatically discovers and runs them, with detailed failure reporting.
See also cerbos · casbin-async-sqlalchemy-adapter · fastapi-users-db-sqlalchemy · sqlalchemy-spanner · casbin-sqlalchemy-adapter · sqlalchemy-adapter · magic-filter · sqlalchemy-solr · ibm-db-sa · sqlalchemy-hana