Pick Cerbos if you need a mature, policy-as-code decision point for application authorization across your services. Pick BehalfID if the thing you need is a human approval gate in front of what your coding agents do, cheap enough to try this afternoon.

Last reviewed 11 August 2026 — competitor capabilities reviewed from publicly available Cerbos materials on that date. Products change; verify current capabilities with each vendor.

Sources: Cerbos pricing, BehalfID capability matrix.

Cerbos is a good policy decision point and has been doing that job longer than BehalfID has existed. If you need fine-grained, testable, version-controlled authorization for users and services, that is what it is built for and a comparison page will not talk you out of it.

The case where the two get compared is narrower: a team has coding agents doing real work, wants production deploys to stop and wait for a person, and starts looking at authorization tooling. A policy decision point answers whether an action is permitted, and the calling application enforces that answer. BehalfID adds the loop around the decision — an approval request that holds the action, a notification to a named reviewer, a record of who decided, and a resulting grant that covers one request and expires.

If you already run Cerbos, you do not need to remove it. It is worth checking whether anything in your current setup pauses an agent mid-action for a person, and building or buying only that piece.

The approval loop is the part teams underestimate when they decide to build it. The decision is the easy half. The rest is the approval record, single-use expiring grants, the notification path, the dashboard a non-author can act in, replay-safe webhooks, and per-integration outage semantics that you can actually explain in a security review.

That is a few weeks of work to get to a demo and considerably longer to get to something you would rely on. At $20/month the question is mostly whether the enforcement points BehalfID offers line up with where your agents act.

If they do not, build it. The honest answer to buy-versus-build for a product this early is that it depends on how much of your risk sits behind integration points we already cover.

Is BehalfID an alternative to Cerbos?

Only for one specific job. Cerbos is a policy decision point for application authorization — may this principal do this to this resource. BehalfID is an approval gate for AI agent actions, including the human-in-the-loop path where an action pauses and waits for a named person. Teams run both.

Cerbos is open source. Why pay $20 a month?

You are not paying for the policy decision — you are paying for the approval loop around it: the approval record, single-use expiring grants, the dashboard a reviewer can act in, replay-safe webhooks, and documented per-integration outage behaviour. If you only need a decision point, Cerbos self-hosted costs nothing in licence fees and is the better fit.

How much does Cerbos cost in production?

Two answers. Self-hosted Cerbos is open source with no licence cost — the cost is running and operating it yourself. For the managed service, Cerbos Hub Production starts at $933/month including the first 5,000 monthly active principals, per Cerbos's published pricing as reviewed 11 August 2026. That is a starting price rather than a flat rate, and pricing changes, so confirm current figures on their pricing page.

How does human approval work in each?

Cerbos is primarily a policy decision point: applications or gateways query it for an authorization decision and enforce the result, so how a human fits into that flow is a question for their current documentation and your design. BehalfID ships the approval loop itself — an approval request holds the action, a named reviewer approves or denies it in the dashboard, the decision is recorded, and the resulting grant covers one request and expires on its own.