Cerbos is a self-hosted, open-source authorization engine (Policy Decision Point) that evaluates access control policies defined in YAML using Common Expression Language (CEL) conditions. It exposes gRPC and HTTP APIs for operations like CheckResources and PlanResources, and supports multiple storage backends (disk, git, cloud blob, SQL databases, and Cerbos Hub). The server is built as a single Go binary with pluggable audit logging (local BadgerDB, Kafka, Hub), OpenTelemetry observability, and a comprehensive CLI admin tool (cerbosctl). Its architecture is modular: policies are compiled into efficient rule tables with bitmap indexing for low-latency evaluation, and the engine supports partial evaluation for resource planning queries. The codebase demonstrates high craftsmanship with clean abstractions, extensive test coverage, and well-designed reusable components such as a custom CEL extension library, a bitmap index for set operations, and a subscription-based event manager for storage changes. It is actively maintained with frequent releases and a growing ecosystem of integrations.