Cerbos

Cerbos 是一个开源的授权层，把权限判断从业务代码里抽出来：用 YAML 写策略，声明谁能对什么资源做什么操作，应用通过 SDK 或 sidecar 询问本地部署的策略决策点，只拿回允许或拒绝。支持 RBAC、ABAC 与资源层级继承，改策略不必重启业务服务，也便于审计。多租户产品，以及 Agent 在调工具之前要先过一遍权限的场景，都可以把它当成统一的一层。 🔗 文档: https://docs.cerbos.dev | GitHub Stars: 4.6k+

Cerbos is an open-source authorization layer that lifts permission checks out of application code: policies are written in YAML declaring who may do what to which resource, and the app asks a locally deployed policy decision point through an SDK or sidecar, getting back allow or deny. RBAC, ABAC and resource hierarchies are supported, policy changes do not require restarting services, and everything stays auditable. Multi-tenant products, and agents that must check permissions before calling a tool, can treat it as one shared layer. 🔗 Docs: https://docs.cerbos.dev | GitHub Stars: 4.6k+