Kerberos.jsAuthorization that runs inside your app

Cerbos-style RBAC + ABAC policies, Zanzibar-inspired ReBAC relations and Cerbos-compatible query plans — zero dependencies, no server to deploy, ~38 KB min+gzip.

Get Started

Why Kerberos.js?

View on GitHub

📭

Zero dependencies

No runtime dependencies at all. ~38 KB min+gzip for the main entry, 20 KB for the /relations subpath — nothing extra in your lockfile, nothing extra in the process that makes your access decisions.

Bundle size

⚡

In-process, sub-millisecond

No network hop to a policy server, no sidecar to operate. Decisions are a function call, which makes per-item checks over a list a realistic thing to do.

Benchmarks

🧩

Cerbos-compatible by design

resourcePolicy / principalPolicy / rolePolicy, derived roles, conditions, variables, constants, outputs and scopes. If you know Cerbos, you already know Kerberos.js.

Policy types

🕸️

ReBAC without a Zanzibar cluster

Relation-backed derived roles plus a built-in SpiceDB-inspired resolver — unions, intersections, exclusions, arrows, caveats, lookupSubjects and lookupResources.

Relations

🔍

Query plans for your database

planResources() returns a Cerbos-compatible condition tree over resource attributes, so you can push authorization down into a SQL/Mongo WHERE clause instead of over-fetching.

Query plans

🗄️

Dynamic policies, any cache

Bring your own Keyv/cacheable/cache-manager store. Policies stored as JSON are evaluated by an eval-free AST interpreter — no new Function, no CSP violations.

Caching

🌐

Node.js and the browser

One platform-specific file, swapped by the package.json browser field. Everything else is platform-neutral, so the same policies run on the server and in the client.

Browser usage

📊

Observable by default

Structured audit logging (Pino-friendly), decision metadata explaining every deny, and optional OpenTelemetry traces and metrics — all opt-in, none of it can change a decision.

OpenTelemetry

✅

Declarative policy tests

A Cerbos-style test DSL on the /tests subpath — describe principals, resources and expected effects as data, and run them against a live engine with node:test.

Testing

Benchmarks

A Kerberos.js decision is a function call inside your process and takes about a microsecond. A policy server answers over the network instead. The chart runs the same checks in Kerberos.js, five JavaScript authorization libraries, OPA and Cerbos, all on one machine. Every library is first checked to reach the same allow and deny decisions.

Ownership condition

A USER may view a document they own: one role-gated rule with an attribute condition. ops/s, log scale — higher is better.

In-process

CASLability built once per user

14.9M

@rbac/rbaccan(role, operation, params)

3.76M

CASLability built per request

1.87M

AccessControltryCan(…).do(…)

955k

Kerberos.jsisAllowed · checkResources

810k

easy-rbaccan(roles, operation, params)

693k

OPARego compiled to WebAssembly, in-process

428k

casbinenforce · batchEnforce

297k

Sidecar — a network round-trip per call

OPA serverREST Data API, sidecar on localhost

2,159

Cerbos PDPgRPC SDK, sidecar on localhost

1,399

Apple M3 Max · 16 cores · Node v24.14.1 · Docker 27.4.0 · median of 5 × 1 s samples, each library in a fresh process · 2026-10-03

Method, cold start, bundle size and the raw numbers →

Used by

Using Kerberos.js in production? Open a PR to add your logo.

Kerberos.jsAuthorization that runs inside your app

Zero dependencies

In-process, sub-millisecond

Cerbos-compatible by design

ReBAC without a Zanzibar cluster

Query plans for your database

Dynamic policies, any cache

Node.js and the browser

Observable by default

Declarative policy tests

Benchmarks ​

Used by ​

Benchmarks

Used by