Top all-time · #3192
Cerbos
Company blog · cerbos.dev/blogsecurityweb
Cerbos is the company blog at cerbos.dev, writing about security and web. Since 2021, 24 different Hacker News readers have linked it 105 times, most often “The productivity paradox of AI coding assistants”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
Too few sampled comments (16) to say how often HN recommends it.?
Why HN links it
HN readers link Cerbos's blog for its writing on why authorization is hard, the limits of RBAC, token bloat, and comparisons with OPA. The blog comes from the company behind the open-source authorization service Cerbos.
Summarised by Claude from a sample of 16 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
End-to-end access control for Zero Trust environments and AI systems. Enforce fine grained contextual authorization in every layer of the software you build
Most-linked posts?
- The productivity paradox of AI coding assistants6 people · 6 mentions · first linked 2025-09-12
- Homegrown security scales and works, if you have a full time dedicated team3 people · 3 mentions · first linked 2021-11-19
- /2 people · 10 mentions · first linked 2021-08-30
- The Costs of User Authorization2 people · 3 mentions · first linked 2021-08-03
- Designing a Zero Trust Architecture: 20 open-source tools to secure every layer2 people · 2 mentions · first linked 2025-04-30
- How to address decentralized data management in microservices – Cerbos2 people · 2 mentions · first linked 2024-11-11
- Statements about Stateless2 people · 2 mentions · first linked 2025-01-30
- GitHub’s Inconsistent Access Control2 people · 2 mentions · first linked 2022-05-19
- /2 people · 2 mentions · first linked 2021-09-17
- The Case for Granular Permissions2 people · 2 mentions · first linked 2021-08-24
What Hacker News says?
I tend to fall in the trap of once you have authenticated the person and passing tokens around that can hold claims/role for authorization, you will eventually reach the point where the tokens are getting so bloated due to the complexity of access controls. AuthN is the next big challenge especially in a multi-tenant/multi-enterprise SaaS type platform https://cerbos.dev/blog/the-hidden-costs-of-user-authorizati...
Comment linking /blog/the-hidden-costs-of-user-authorization
on “API Tokens: A Tedious Survey”Submitted CRDTs and Collaborative Playground as a story · 111 points
HN discussionDisclaimer: I am Product Lead @ Cerbos[0] - an open-source authorization service This article is a great summary of exactly why this area is rife for innovation and we love seeing different approaches to solve the headache of authz. Coincidentally I have just published a write up of why authorization has been so hard from a Product Management and requirements perspective. https://alexolivier.me/posts/the-never-endin…
Comment linking /
on “Why Authorization Is Hard”Submitted Keeping documentation in sync with source code as a story · 45 points
HN discussionCerbos | Remote | Worldwide | Full-time | DevRel Manager Cerbos is an open source enterprise-grade access management service for any application. We are building a decoupled authorization service for those who do not want to reinvent the wheel when it comes to user permissions, authorization, RBAC, ABAC etc. We are looking for an experienced dev-rel manager to join our globally remote team. You will be in charge of…
Comment linking /join-us
on “Ask HN: Who is hiring? (April 2022)”Submitted Cerbos Hub: Simplifying Authorization for Developers as a story · 13 points
HN discussionDisclaimer: I am the co-founder of Cerbos. Thanks for explaining the problem space so well and referring to Cerbos[1] as contextual solution. We had to build these systems in the past so many times and we were tired of reinventing the wheel. With Cerbos we aim to turn this problem space into configuration rather than code and enable enterprise-grade access management for any application. [1] https://cerbos.dev
Comment linking /
on “Authorization in a Microservices World”Submitted The productivity paradox of AI coding assistants as a story · 10 points
HN discussionHaving wasted a couple of engineers time a year on building and managing permissioning systems, the challenge and complexity really rings true This is especially painful in B2B businesses where your customers have their own set of requirements and access controls (this department can do X, but these 3 people also have access to these other 2 departments etc). The hidden cost of supporting this plus the audit overhea…
Comment linking /blog/the-hidden-costs-of-user-authorization
on “Role-based access control like it was meant to be”Submitted Practices that set great software architects apart as a story · 9 points
HN discussionRBAC can get you a long way, but there comes a time when you need even more granular permissions that are context aware (eg is the user an owner of the thing they are accessing and are they accessing from an internal IP address) https://cerbos.dev/blog/the-case-for-granular-permissions
Comment linking /blog/the-case-for-granular-permissions
on “Role-based access control like it was meant to be”Submitted GitHub’s Inconsistent Access Control as a story · 9 points
HN discussionI hear you! Ended up building such a system so many times, so much we've built an open-source, self-hosted system to do it out of the box! https://cerbos.dev Would love your feedback!
Comment linking /
on “Role-based access control like it was meant to be”Submitted The Case Against Token-Based Authorization as a story · 9 points
HN discussionI wish there was an AI tool that made me faster at coding[1]. /s [1] https://www.cerbos.dev/blog/productivity-paradox-of-ai-codin...
Comment linking /blog/productivity-paradox-of-ai-coding-assistants
on “AI tools I wish existed”Submitted The productivity paradox of AI coding assistants as a story · 8 points
HN discussionCongrats to the team and Apple! It's great to see authorization getting more attention in the mainstream developer conversation. For folks exploring policy-based authorization solutions, we've written up a detailed comparison between Cerbos and OPA that might be helpful: https://www.cerbos.dev/blog/cerbos-vs-opa The key differences tend to be around developer experience, policy language complexity, and deployment pa…
Comment linking /blog/cerbos-vs-opa
on “OPA maintainers and Styra employees hired by Apple”Submitted Cerbos and FusionAuth [video] as a story · 7 points
HN discussionDisclaimer, I am a founder of Cerbos. At Cerbos, rather than writing policies in Rego, you can write them in a much simpler YAML/JSON (much more like AWS IAM) (a bit late to the party) Hi Fabian, At Cerbos we had to handle this issue as well and wrote a blog post about [1] how we can convert a policy into a generic AST that you can use in your data filtering logic on your data storage. This way you can empower your…
Comment linking /blog/fully-featured-authorization-for-your-prisma-app-with-cerbos
on “Aserto: Developer API for permissions and RBAC”Submitted Certifications for Software Architects as a story · 6 points
HN discussionOPA and its derivative projects really brought the idea of decoupled authorization as a viable option. It is a very powerful tool which can be applied to many layers of the architecture - from Kubernetes Admission Controllers being based on it through to network level authorization and up the full stack. One area that is a constrained and narrow use case is around the actual application level permissions - eg what a…
Comment linking /
on “Open Policy Agent”Submitted How I implemented a solution to use react-query with Remix's loader functions as a story · 6 points
HN discussionDisclaimer: I am the co-founder of Cerbos Broken access control becoming the number one issue is no surprise. We have faced this so many times when building enterprise SaaS software and having to go through ISO certifications. We believe re-invention of the access control wheel causes these problems at every software company because there is no good standards to start from. With Cerbos we try to address this issue i…
Comment linking /blog/broken-access-control-is-the-1-issue-in-owasp-2021-top-10
on “OWASP top 10 change visualization from 2004 to now”Submitted Practices that set great software architects apart as a story · 5 points
HN discussionBuilt-in logging is definitely one of the main benefits. However, the following are also other major benefits of using a service like Cerbos: * By running as a standalone service, any part of your application stack (in any language) can make consistent authorization checks * Support for most major programming languages via SDKs * Infinite scalability via serverless functions or sidecar deployment model * GitOps enab…
Comment linking /product-features
on “Ask HN: What do you use to build auth?”Submitted Top identity and access management (IAM) tools for 2024 as a story · 5 points
HN discussionDisclaimer: I am the co-founder of Cerbos[0] Auth is actually a combination of two things: authentication and authorization. Whatever you do, please do not build either by yourself. It always starts simple and it is guaranteed to get more complex than anyone is willing to maintain (unless you have a dedicated security engineering team) There are many providers for each. Authentication is about the user's identity an…
Comment linking /blog/fully-featured-authorization-for-your-prisma-app-with-cerbos
on “Ask HN: What do you use to build auth?”Submitted Filtering data using authorization logic as a story · 5 points
HN discussionDisclaimer: I work for Cerbos[0]. Whilst this is a very good approach when all your data is stored in a single datastore, as applications grow it is common to start breaking out into more optimised data stores eg you may have few relational databases, a fast lookup source and a search index. This presents a problem of enforcing authorization down into each system. An alternate way to tackle this is to have the autho…
Comment linking /blog/filtering-data-using-authorization-logic
on “Hands-On with PostgreSQL Authorization – Part 2 – Row-Level Security”Submitted Most Common Authorization Designs for SaaS Products as a story · 5 points
HN discussion
