What is authorization policy as code?

Authorization policy as code means writing the access rules for your application as policy files instead of keeping them in service code. The files live in Git, changes go through pull requests, and tests run before anything ships. Security reviewers can read the rules directly, and the history shows who changed what and when.

How do you test authorization policies before they reach production?

You test authorization policies by shipping tests with each policy that state what each role should and should not be able to do, and running them in CI on every commit. Cerbos Hub also validates and tests every policy change it receives, and only sends a change to your policy decision points if it passes.

How does policy as code help with authorization audits?

Policy as code helps with authorization audits because every rule change has a reviewed history, and every decision can be tied back to a policy. In Cerbos Hub each decision is logged with who asked, the action, the resource, the result and which policy applied, which answers the auditor’s question of which policy was in effect at the time.

What language are Cerbos policies written in?

Cerbos policies are written in YAML, with conditions in CEL, the Common Expression Language. A security reviewer can read a rule without knowing the code of the service that enforces it, so security and engineering review the same rule.

Cerbos Featured in the GigaOm Radar for Security Policy as Code

Cerbos is featured in the October 2026 edition of the GigaOm Radar for Security Policy as Code.

Cerbos is an authorization management platform, so the part of policy as code we work on is the access rules inside your product, who can view a record, approve a payment, or call a tool on someone’s behalf.

Infrastructure teams have worked this way for years, with cloud configuration and Kubernetes admission rules kept in Git, reviewed, and tested before they ship. Access rules inside applications are often still the exception. They sit in service code, and when an auditor asks which rule was in effect on a given day, the answer has to be pieced together from several services. Keeping those rules in one place, outside the code, is what externalized authorization means, and policy as code is how that place stays reviewable.

Access rules in policy files get reviewed like any other code

When an access rule lives in a policy file, changing it means opening a pull request. Someone reviews it, and the history shows who changed the rule, when, and why. Cerbos policies are YAML, with conditions written in CEL (Common Expression Language), so a security reviewer can read a rule without reading the service that enforces it. We wrote up the longer case for GitOps in authorization if you want it.

Policy tests catch a bad access rule before it reaches production

A policy can ship with tests that state what each role should and should not be able to do, and your own CI can run them on every commit. In the Cerbos platform, Cerbos Hub validates and tests every policy change it receives. Only a change that passes gets built and sent, within seconds, to the policy decision points your services call to check access. A rule that breaks a test stays out of production. Changes can come straight from a connected GitHub repository, or from your existing CI/CD pipeline through the API.

Every authorization decision leaves an audit record

In Cerbos Hub, each decision is logged with who asked, what they asked to do, on which resource, whether it was allowed, and which policy applied. That is the record an auditor means when they ask to see the policy that was in effect at the time, and it is hard to produce when the same rule lives in several services. Our audit logs page covers what gets captured, and the post on authorization blind spots covers what auditors tend to find when there is no record like this.

Trace one recent access change to see where your rules stand

Pick one access rule that changed in the last few months and follow it back. Where was it changed, who reviewed it, how was it tested, and could you show an auditor which decisions it affected? If answering takes a day of digging through several services, that rule is a good first candidate to move into a policy.

Try Cerbos to keep every access rule across your applications, gateways, workloads and AI agents in policy that is reviewed and tested before it ships, with a record of which policy applied to every decision. Or book a call to talk through your setup with our team.