One more quick question. If I wanted to provide a way for users to add their own roles and policies, is that something that Cerbos supports? I know there is an admin api to create policies, but is that the recommended way to allow users to create dynamic roles and policies?

It's possible with Cerbos. It does involve some work on the implementation side and we are actively thinking about ways to make that easier. Because it's stateless, Cerbos doesn't store role assignments so those has to come from your identity provider or application. You can then generate policies for those roles and add them to Cerbos using the Admin API. You might not want to expose Cerbos policies directly to your users for UX and security reasons so that's where bulk of the work is because we currently don't have a policy builder UI that you can integrate.