Cerbos is stateless by design and was in fact born out of our experience of running services that handled 100k+ RPS with millisecond latency. It does not pull any data from other external sources, rather all the information required to make a decision is passed in the call to check if a request is authorized. Cerbos makes decisions based on the policies and the context provided at the request time. In most cases, the context is already in the services making the check. (it knows which user/principal and the resources that are being accessed).

Because Cerbos makes decisions based on contextual data, caching is not very straightforward to implement. Response times are pretty good even without caching. We are constantly working on trying to find ways to make things quicker all the time and that may or may not involve caching.

We are working on producing a reproducible and realistic benchmark for public consumption. In our internal tests, the 95th percentile response times have been always under 10ms. Of course, this depends a lot on how complex the policies are and how much data there is to process.