Styra OPA vs Cerbos: which should I use?

Use Open Policy Agent when one policy engine must cover Kubernetes admission, infrastructure and APIs, and your team can write Rego. Use Cerbos when the need is application authorization, product engineers will maintain the rules, and you want YAML policies plus a commercial control plane and support contract you can still buy.

What happened to Styra?

On 20 August 2025 the OPA blog announced that OPA's creators and many Styra staff had joined Apple. OPA itself stayed a CNCF project under Apache 2.0 with no governance change, and Styra's Enterprise OPA was donated to the community and its repository archived. The announcement did not address Styra DAS or commercial support, and the styra.com domain did not resolve when we checked in October and again on 2026-11-05.

Is Open Policy Agent still maintained?

Yes. OPA has been a CNCF Graduated project since 29 January 2021, and OPA Control Plane and the Regal linter live in the CNCF open-policy-agent GitHub organization. Treat it as a community project and budget for internal support rather than a vendor contract.

Do I need to learn Rego to use Cerbos?

No. Cerbos policies are YAML resource and principal policies, tested in CI and evaluated by a stateless decision point. That lower barrier is the main reason product teams pick it over OPA for application authorization.

How much do OPA and Cerbos cost?

OPA, OPA Control Plane and Regal are free. Cerbos's engine is free; Cerbos Hub (checked 2026-11-05) is free up to 100 monthly active principals, Development starts at 25 dollars a month and Production at 933 dollars a month with 5,000 principals included.

Styra OPA vs Cerbos: 2026 Status and Verdict, Comparison

Styra OPA vs Cerbos: 2026 Status and Verdict

CapabilityStyra / Open Policy AgentCerbos

Overall

4.3

4.0

Authentication: 1.5; 1.5
SSO & Federation: 2.0; 1.5
Authorization: 4.6; 4.5
Lifecycle & Provisioning: 3.5; 3.0
MFA & Passwordless: 1.0; 1.0
Governance & Audit: 4.3; 3.5
Developer Experience: 3.8; 4.5
Deployment Flexibility: 4.7; 4.5
Pricing Transparency: 3.0; 4.0
Support & Ecosystem: 4.0; 3.5

Scored 0–5 against a published rubric. Bold marks the higher score. Independent analysis, no vendor sponsorship.

Verdict

Styra OPA vs Cerbos is general-purpose policy versus focused application authorization. Open Policy Agent (OPA) is the CNCF-graduated, Rego-based engine teams use for Kubernetes admission, infrastructure and API policy, but Styra is no longer a vendor you can count on after its founders joined Apple in August 2025. Cerbos is built for application authorization, with YAML policies product teams can read and an actively sold control plane, Cerbos Hub. Choose OPA when policy spans the whole stack; choose Cerbos when the job is "can this user do this to this resource". Profile scores: OPA 4.3, Cerbos 4.0.

Where each wins

Decision factor	Styra / OPA	Cerbos
Scope	Wins: Kubernetes, infra, APIs, apps	Application authorization
Policy language	Rego, powerful but steep	Wins: YAML with conditions
Ecosystem	Wins: CNCF Graduated since 2021	Smaller, vendor-led
Commercial support	None we can verify	Wins: Cerbos Hub and Enterprise
List filtering for UIs	Partial evaluation	Query plans built in
Price of a managed control plane	Self-run OPA Control Plane	Hub from $0

Both are policy-as-code, unlike the Zanzibar relationship engines; see OpenFGA vs AuthZed vs Cerbos for that model.

Pricing reality (checked 2026-11-05)

OPA, OPA Control Plane and Regal are Apache 2.0 and free. We found no Styra DAS price list or support offer, and styra.com did not resolve on 2026-11-05.

Cerbos's pricing page keeps the engine free and bills Cerbos Hub on monthly active principals, meaning users or non-human identities authorized in a month. Proof of Concept is free to 100 principals; Development starts at $25 a month with a 3-month trial; Production starts at $933 a month with 5,000 included. Graduated rates fall from $0.25 per principal to $0.062 at 100,000, yearly billing takes 15% off, and Enterprise is custom. Model it against running OPA yourself with the TCO calculator.

Ownership and status changes

The OPA blog announced on 20 August 2025 that OPA's creators and many Styra staff had joined Apple, with no change to OPA governance or licensing. Styra's Enterprise OPA repository was archived and donated to the community. OPA has been CNCF Graduated since 29 January 2021. Cerbos Inc. is private and open-core.

Deployment and architecture

OPA runs as a library, sidecar or daemon. It evaluates Rego against JSON input plus data bundles, so it can decide almost anything, from a pod spec to an HTTP request. That generality means you design the input schema, data loading and decision logging yourself.

Cerbos runs a stateless policy decision point as a sidecar or service. Your app sends principal and resource attributes per request, and resource and principal policies, tested in CI, return allow or deny. Query plans let you turn a policy into a database filter for list views.

Migration notes

Moving application authorization from OPA to Cerbos means rewriting Rego rules as resource policies and aligning your input documents to Cerbos's principal and resource shape. Port the test suite first, then run both engines in shadow mode and compare decisions. Keep OPA for Kubernetes admission and infrastructure policy, where Cerbos does not compete; many teams run both.

Who should pick which

OPA: platform and security teams standardizing policy across Kubernetes, infrastructure and services, with the skills to own it without a vendor.
Cerbos: product teams that need ABAC or RBAC application authorization fast, with a support contract.
Both: OPA at the infrastructure layer, Cerbos inside applications.

Frequently asked questions

Styra OPA vs Cerbos: which should I use?: Use Open Policy Agent when one policy engine must cover Kubernetes admission, infrastructure and APIs, and your team can write Rego. Use Cerbos when the need is application authorization, product engineers will maintain the rules, and you want YAML policies plus a commercial control plane and support contract you can still buy.
What happened to Styra?: On 20 August 2025 the OPA blog announced that OPA's creators and many Styra staff had joined Apple. OPA itself stayed a CNCF project under Apache 2.0 with no governance change, and Styra's Enterprise OPA was donated to the community and its repository archived. The announcement did not address Styra DAS or commercial support, and the styra.com domain did not resolve when we checked in October and again on 2026-11-05.
Is Open Policy Agent still maintained?: Yes. OPA has been a CNCF Graduated project since 29 January 2021, and OPA Control Plane and the Regal linter live in the CNCF open-policy-agent GitHub organization. Treat it as a community project and budget for internal support rather than a vendor contract.
Do I need to learn Rego to use Cerbos?: No. Cerbos policies are YAML resource and principal policies, tested in CI and evaluated by a stateless decision point. That lower barrier is the main reason product teams pick it over OPA for application authorization.
How much do OPA and Cerbos cost?: OPA, OPA Control Plane and Regal are free. Cerbos's engine is free; Cerbos Hub (checked 2026-11-05) is free up to 100 monthly active principals, Development starts at 25 dollars a month and Production at 933 dollars a month with 5,000 principals included.

Last updated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.