Engineering
All articles tagged Engineering.
Agent skill for writing authorization policies in OpenCode
OpenCode is open source, self-hosted, and provider-agnostic, so the whole authorization policy workflow stays inside your security perimeter. This guide walks through installing the Cerbos policy skill in OpenCode, drafting policies in plain English, validating against the real Cerbos compiler locally, and pairing the skill with AGENTS.md.
Agent skill for writing authorization policies in Pi
Pi is the open-source self-extensible coding agent built around the Agent Skills standard from the start. This guide walks through installing the Cerbos policy skill in Pi, invoking it with /skill:cerbos-policy, drafting authorization policies in plain English, and validating against the real Cerbos compiler in Docker.
Mastering hierarchy-based permissions with Cerbos: Policy-defined roles vs. dynamic attributes
Learn how to handle authorization in applications with hierarchical data. In this post, we explore two approaches to implementing hierarchy-based permissions. Both methods leverage Attribute-Based Access Control.
The Cerbos Hub effect matrix: read your authorization policy at a glance
See how the Cerbos Hub effect matrix turns authorization policy files into a permissions grid of roles and actions, with allowed, denied, and conditional outcomes. Read what each role can do without parsing raw policy, drill into ABAC conditions, and spot over-permissive wildcard rules in review.
Agent skill for writing authorization policies in AWS Kiro
AWS Kiro is spec-driven, which means the access model is captured properly before any YAML gets written. This guide walks through installing the Cerbos policy skill in Kiro, the spec-then-policy workflow, how the skill picks up AWS Cognito attributes, and how validation runs against the real Cerbos compiler.
Fine grained access control: What it actually takes to get it right
Fine grained access control lets you authorize based on user attributes, resource ownership, and context instead of broad roles. This guide covers RBAC, ABAC, ReBAC, PBAC models, embedded vs. externalized authorization, real policy examples, and practical implementation patterns for engineering teams.
Authentication vs Authorization
Authentication vs authorization explained. AuthN verifies who a user is, AuthZ decides what they can do. This guide covers ID and access tokens, OAuth 2.0, OpenID Connect, SAML, SSO, RBAC and ABAC, the key differences between the two, and the mistakes teams make building them.
Agent skill for building Cerbos Synapse extensions
A new agent skill that builds Cerbos Synapse extensions for you. Describe what you want to enrich, map, or expose, and it picks the extension kind and runtime, scaffolds the files, wires config, and runs it against a local PDP. Covers CEL, Starlark, and WASM in Go, TypeScript, or Python.
Mapping business requirements to authorization policy for e-commerce
A practical walkthrough of how e-commerce business rules become authorization policy. Covers customer data access, vendor product management, and order lifecycle control using RBAC, ABAC, and PBAC in Cerbos. Includes derived roles, attribute conditions, time-based rules, and a built-in test framework to verify each policy before production.
Governing AI agents at the gateway with Cerbos and agentgateway
How to govern AI agents at the gateway with agentgateway and Cerbos. This covers the three authorization questions on every agent hop, which model an identity can call, which MCP servers and tools it can open, and what a tool call is actually asking for, all from one policy bundle over Envoy ext_authz.
How to secure AI agents and MCP tools at the gateway with LiteLLM and Cerbos
Add policy-based authorization to a LiteLLM AI gateway with Cerbos. Control which models each user or agent can call, hide tools the caller shouldn't see, and bind MCP tool arguments to caller attributes, all enforced at the proxy with no application changes.
Agent skill for writing authorization policies in Claude Code
Claude Code lets engineers draft authorization policies in plain English, right in the terminal. This guide covers installing the policy skill through the plugin marketplace, invoking it with /cerbos-policy, what a session looks like, validating against the real Cerbos compiler in Docker, and where human review still matters.
Mapping business requirements to authorization policy for automotive
Authorization in enterprise automotive platforms covers more than roles. This guide explains why RBAC fails for software-defined vehicles, how ABAC and policy-as-code govern OTA updates, ECU diagnostics, and supplier access, and how Cerbos handles workforce, partner, customer, and non-human identities across the vehicle lifecycle.
Agent skill for writing authorization policies in Claude Desktop
Claude Desktop lets product, security, and engineering leads draft Cerbos authorization policies in plain English without writing YAML. This guide walks through installing the Cerbos policy skill, connecting your specs via MCP, validating against the real compiler, and producing a complete policy bundle ready for review and PR.
Query plan adapter for Elasticsearch (Java)
Externalized authorization with Cerbos. Translate policies into native Elasticsearch Query DSL using the PlanResources API. Push access control to the database layer, avoid post-fetch filtering, and scale secure search with nested query support and operator overrides.
Integrating Cerbos with Kong: A how-to guide for API gateway authorization
Learn how to integrate Cerbos with Kong to offload authorization decisions from your services and centralize policy enforcement at the gateway. This hands-on guide walks through a real setup using Docker Compose, custom plugins, and fine-grained access policies to secure every API request.
Tokens are authorization decisions: a guide to policy-driven token issuance
Tokens are authorization decisions, and most identity teams don't manage them like one. This article explains policy-driven token issuance, the three patterns Gartner calls Authorization Management Platforms, what AuthZEN changes, and how to govern AI agent tokens without hardcoding logic into the IdP.
Query plan adapter for Convex
Externalized authorization with Cerbos moves access control into policy files and pushes filtering to the data layer. Learn how the PlanResources API and a new Convex adapter generate efficient, secure queries without row-by-row checks.