Kerberos.jsAuthorization that runs inside your app

Cerbos-style RBAC + ABAC policies, Zanzibar-inspired ReBAC relations and Cerbos-compatible query plans — zero dependencies, no server to deploy, ~25 KB min+gzip.

Get Started

Why Kerberos.js?

View on GitHub

📭

Zero dependencies

No runtime dependencies at all. ~25 KB min+gzip for the main entry, 15 KB for the /relations subpath — nothing extra in your lockfile, nothing extra in the process that makes your access decisions.

Bundle size

⚡

In-process, sub-millisecond

No network hop to a policy server, no sidecar to operate. Decisions are a function call, which makes per-item checks over a list a realistic thing to do.

Why in-process

🧩

Cerbos-compatible by design

resourcePolicy / principalPolicy / rolePolicy, derived roles, conditions, variables, constants, outputs and scopes. If you know Cerbos, you already know Kerberos.js.

Policy types

🕸️

ReBAC without a Zanzibar cluster

Relation-backed derived roles plus a built-in SpiceDB-inspired resolver — unions, intersections, exclusions, arrows, caveats, lookupSubjects and lookupResources.

Relations

🔍

Query plans for your database

planResources() returns a Cerbos-compatible condition tree over resource attributes, so you can push authorization down into a SQL/Mongo WHERE clause instead of over-fetching.

Query plans

🗄️

Dynamic policies, any cache

Bring your own Keyv/cacheable/cache-manager store. Policies stored as JSON are evaluated by an eval-free AST interpreter — no new Function, no CSP violations.

Caching

🌐

Node.js and the browser

One platform-specific file, swapped by the package.json browser field. Everything else is platform-neutral, so the same policies run on the server and in the client.

Browser usage

📊

Observable by default

Structured audit logging (Pino-friendly), decision metadata explaining every deny, and optional OpenTelemetry traces and metrics — all opt-in, none of it can change a decision.

OpenTelemetry

✅

Declarative policy tests

A Cerbos-style test DSL on the /tests subpath — describe principals, resources and expected effects as data, and run them against a live engine with node:test.

Testing

Used by

Using Kerberos.js in production? Open a PR to add your logo.