[jonahbenton]

Other options are Casbin, Cedar, and OPA. It looks like cerbos is really only for roles and rules, and unlike those others would not be a good fit for an ACL-type system that required object-based permissions.