Enforcer

Cerbos alternatives

Cerbos is a good product and has the shortest quickstart in this category: three commands, no account. Most people looking for an alternative are hitting one of two specific limits, so this starts there rather than with a feature grid.

Why people look

List filtering. The most common complaint by far. Answering "give me every resource this user can read" is awkward, and people end up wanting an AST-to-SQL transformer that isn't there.
Opt-out telemetry. It was the top comment on their own launch thread and it still puts some organisations off.

If neither of those is your problem, staying put is usually the right answer.

The options

Option	Model	Strength	Trade-off
OpenFGA	Relationship, Zanzibar	Strong list filtering	You maintain a copy of your data, written twice
SpiceDB / AuthZed	Relationship, Zanzibar	Mature, good tooling	Same dual-write problem; their own CTO names it
Open Policy Agent	Policy, Rego	One engine for infra and app	Rego is the most complained-about language here
Permit.io	Policy plus MCP gateway	UI for non-engineers	Still a decision layer, still syncs
WorkOS FGA	Relationship plus roles	Comes with sign-in	Resources registered in their system
Enforcer	Policy over a resolved caller	Nothing to sync; identity included	No list filtering, same gap as Cerbos

What we do differently

Cerbos is stateless, so you pass the context in on every request. Enforcer signed the user in, so the policy is handed the resolved caller with role, tenant and group memberships already attached. Neither of us makes you maintain a shadow database, which is the real dividing line in this category.

Being straight about it: we share Cerbos's list-filtering gap. If that is why you are here, a relationship engine is your answer, not us.

Last updated 2026-09-11. Enforcer is identity and authorization in one system, for applications and AI agents. Docs at docs.instruxi.dev.