# openfga-vs-cerbos

Source: https://startwithidentity.com/compare/openfga-vs-cerbos/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## The honest comparison

[OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/) and [Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/) score 4.2 and 4.0 and are both good products that solve authorization differently enough that a benchmark comparison misleads.

OpenFGA is a CNCF project implementing the Google Zanzibar model: permissions are relationships stored as tuples, and a check traverses the graph. That makes it strong at exactly the cases roles cannot express, document sharing, nested folders, inherited group membership, and it can answer reverse queries such as which objects a user can see. The cost is that you now run a stateful service and must keep those tuples consistent with your application's own data.

Cerbos is stateless [policy-as-code](https://startwithidentity.com/glossary/abac/). You send a principal, a resource with its attributes, and an action; policies written in YAML return a decision. No data store, no synchronization, no consistency window, and policies can be versioned and tested like any other code. The cost is that every attribute a decision depends on must be present in the request.

## When OpenFGA wins

- Access derives from relationships: ownership, sharing, membership, and inheritance
- You need [fine-grained authorization](https://startwithidentity.com/glossary/fga/) over many individual objects rather than resource types
- Reverse queries matter: listing what a user can see, not just checking one object
- The Zanzibar model matches how your product already thinks about permissions
- A managed path exists through Okta FGA if you would rather not operate it

## When Cerbos wins

- Access derives from attributes already present on the request
- You do not want a second stateful service or the consistency problem that comes with it
- Policy-as-code that reviewers can read, version, and test is the priority
- Sidecar deployment with predictable latency and no external dependency
- [ABAC](https://startwithidentity.com/glossary/abac/) or role-plus-condition models rather than deep relationship graphs

## Pricing

OpenFGA is free and open source under Apache 2.0 for self-hosting, and you own operations including availability and the tuple store. Okta FGA is the managed, paid option with support and SLAs.

Cerbos's core engine is free and open source under Apache 2.0. Cerbos Hub adds a free tier plus paid plans for policy management, distribution, and audit at scale. Model self-hosted operations against managed in both cases with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/), remembering that an authorization service sits on every request path.

## Verdict

Model your authorization first, then pick. If permissions are relationships, [OpenFGA](https://startwithidentity.com/vendors/authorization/openfga/). If they are attributes and rules, [Cerbos](https://startwithidentity.com/vendors/authorization/cerbos/), and you will spend less time on infrastructure. See [OpenFGA vs Authzed vs Cerbos](https://startwithidentity.com/compare/openfga-vs-authzed-vs-cerbos/), [Styra OPA vs Cerbos](https://startwithidentity.com/compare/styra-opa-vs-cerbos/), [best authorization tools](https://startwithidentity.com/rankings/best-authorization-tools/), and [RBAC vs ABAC vs ReBAC](https://startwithidentity.com/guides/fundamentals/rbac-vs-abac-vs-rebac/).