GoRules vs. Cerbos

Most decision logic lives twice: once in a spec somebody wrote, once in code somebody else shipped. GoRules collapses the two. Analysts read and edit rules as plain sentences, engineers see the same rules as typed expressions, and neither view can drift because both render from one compiled source. Decisions can be modeled visually on a graph, kept in decision tables, or written as policy documents that mix prose with executable blocks. Under the hood runs ZEN, an open-source Rust engine (MIT) that returns answers in roughly 10 microseconds and embeds natively in Node.js, Python, Go, Java, Kotlin, C#, Swift, and Rust applications, so the identical ruleset powers APIs, MCP-connected AI agents, and Spark pipelines. Changes are guarded the way software is: static checks flag type errors, dead rules, and conflicting policies; scenario suites measure coverage; releases promote through environments with approvals and rollback. Free tier on managed cloud; self-hosted available.

Most companies write permission checks straight into each application, which makes access hard to change, hard to review and hard to prove to an auditor. Cerbos moves those rules into one authorization management platform that covers applications, API gateways, service meshes, data platforms and AI agents. Teams describe who can do what in short policy files that people outside engineering can read. Role, attribute and relationship rules (RBAC, ABAC, ReBAC and PBAC) live side by side. When a request comes in, Cerbos pulls the current roles and attributes from Okta, Microsoft Entra ID, your databases or internal APIs, then checks the request against the policy. A change to the rules ships after its tests pass, with no application release. What each team gets For engineering, one API call takes the place of permission logic spread across services, with SDKs in eight languages including Go, Java, Python and JavaScript. For identity teams, a single place to manage access for employees, customers, services and AI agents, next to the identity provider they already run. For product teams, custom roles and per-tenant permissions for enterprise customers without building them one customer at a time. For security teams, every AI agent tool call goes through the same policy check as a person, so agent rollouts can be approved with controls in place. Each check is recorded along with the policy that applied, which gives SOC 2, ISO 27001 and HIPAA audits a clear trail. Deploy it as a hosted service, in your own cloud or fully air-gapped. Customers running Cerbos in production include Utility Warehouse, 9fin and Salesroom.