Documentation
All articles tagged Documentation.
Agent skill for building Cerbos Synapse extensions
A new agent skill that builds Cerbos Synapse extensions for you. Describe what you want to enrich, map, or expose, and it picks the extension kind and runtime, scaffolds the files, wires config, and runs it against a local PDP. Covers CEL, Starlark, and WASM in Go, TypeScript, or Python.
Governing AI agents at the gateway with Cerbos and agentgateway
How to govern AI agents at the gateway with agentgateway and Cerbos. This covers the three authorization questions on every agent hop, which model an identity can call, which MCP servers and tools it can open, and what a tool call is actually asking for, all from one policy bundle over Envoy ext_authz.
Introducing Cerbos Hub Insights: A live view of what your authorization layer is doing
Cerbos Hub Insights aggregates the decisions your PDPs make into charts and rankings, so patterns like a spike in denials become obvious without scrolling the audit log. Track allows, denies, and active principals over time, built entirely from audit data you already send to Cerbos Hub.
Agent skill for writing authorization policies in Claude Code
Claude Code lets engineers draft authorization policies in plain English, right in the terminal. This guide covers installing the policy skill through the plugin marketplace, invoking it with /cerbos-policy, what a session looks like, validating against the real Cerbos compiler in Docker, and where human review still matters.
Agent skill for writing authorization policies in Claude Desktop
Claude Desktop lets product, security, and engineering leads draft Cerbos authorization policies in plain English without writing YAML. This guide walks through installing the Cerbos policy skill, connecting your specs via MCP, validating against the real compiler, and producing a complete policy bundle ready for review and PR.
Query plan adapter for Elasticsearch (Java)
Externalized authorization with Cerbos. Translate policies into native Elasticsearch Query DSL using the PlanResources API. Push access control to the database layer, avoid post-fetch filtering, and scale secure search with nested query support and operator overrides.
Query plan adapter for Convex
Externalized authorization with Cerbos moves access control into policy files and pushes filtering to the data layer. Learn how the PlanResources API and a new Convex adapter generate efficient, secure queries without row-by-row checks.
Query plan adapter for Drizzle ORM
Externalized authorization with Cerbos PlanResources API and Drizzle ORM. Generate efficient, policy-driven SQL filters from query plans. Avoid row-by-row checks, reduce database I/O, and enforce scalable access control at the query layer with @cerbos/orm-drizzle.
From maps to bitmaps (and from bitmaps to bitmaps)
Inside the Cerbos PDP performance rewrite that took authorization decisions from 43.8 µs to 6.6 µs. This post walks through three iterations of the rule table index, why roaring bitmaps weren't the right fit, and how a custom bitmap with a meta layer beat both the previous index and roaring.
Query plan adapter for LangChain.js and ChromaDB
Enforce fine-grained authorization in RAG apps with Cerbos and ChromaDB. Learn how @cerbos/langchain-chromadb converts Cerbos query plans into ChromaDB filters, so vector search respects access policies at retrieval time and prevents unauthorized data from reaching your LLM.
Cerbos PDP v0.52.0/v0.53.0: Engine performance, security hardening, and CEL path functions
Cerbos PDP v0.52.0 and v0.53.0 bring engine performance optimizations, new CEL path functions, and tighter JWT security. This release recap covers faster decision generation, the new cerbosctl hub auth command, audit log version metadata, query plan scope fixes, and the OpenTelemetry Semantic Conventions 1.39.0 breaking change.
Agent skill for writing authorization policies
Writing authorization policies from a blank file is slow. The Cerbos agent skill handles the drafting for you, asking clarifying questions in plain English before generating a full Cerbos policy bundle with schemas, roles, resource policies, and tests. Works with Claude Code, Cursor, Codex, and more.
How to add authorization to legacy applications without code changes
Learn how to add authorization to legacy applications without modifying a single line of code. This guide covers the gateway pattern with Cerbos Synapse and Envoy, route-level policy enforcement, device posture checks, audit trail coverage, and a phased path from zero visibility to full authorization governance.
Row-level security for Apache Trino, powered by Cerbos Synapse
Add row-level security, column masking, and table-level access control to Apache Trino using Cerbos policies. No Rego, no custom plugins. Covers policy examples, attribute-based filtering from your IdP, per-role masking rules, and compliance audit logging through Cerbos Hub.
Top 9 Identity & Access Management (IAM) Tools for 2026
IAM tools are essential for enhancing security, streamlining access management processes, and ensuring compliance in organizations. In this blog, we're going to discuss the top 9 identity and access management (IAM) tools of 2026.
Policy as Code with Azure API Management and Cerbos
Integrate Cerbos with Azure API Management to externalize API authorization. Deploy Cerbos PDP on Azure Container Apps, enforce RBAC and ABAC at the gateway, validate JWTs, and manage versioned policies independently from backend services for scalable, secure access control.
Cerbos PDP v0.51.0: Policy lifecycle management, audit enhancements, and scopes
Cerbos PDP v0.51.0 introduces new Admin API features for policy lifecycle management, enhanced audit logging with request context, improved test filtering, and critical scope handling fixes to ensure consistent, reliable authorization decisions at scale.
Cerbos Hub Playground: Recent updates
Explore the latest Cerbos Hub Playground updates, including permission matrices, execution traces, diff views, templates, and sandboxed policy testing to build and debug authorization faster.