Engineering
All articles tagged Engineering.
Query plan adapter for Drizzle ORM
Externalized authorization with Cerbos PlanResources API and Drizzle ORM. Generate efficient, policy-driven SQL filters from query plans. Avoid row-by-row checks, reduce database I/O, and enforce scalable access control at the query layer with @cerbos/orm-drizzle.
From maps to bitmaps (and from bitmaps to bitmaps)
Inside the Cerbos PDP performance rewrite that took authorization decisions from 43.8 µs to 6.6 µs. This post walks through three iterations of the rule table index, why roaring bitmaps weren't the right fit, and how a custom bitmap with a meta layer beat both the previous index and roaring.
Query plan adapter for LangChain.js and ChromaDB
Enforce fine-grained authorization in RAG apps with Cerbos and ChromaDB. Learn how @cerbos/langchain-chromadb converts Cerbos query plans into ChromaDB filters, so vector search respects access policies at retrieval time and prevents unauthorized data from reaching your LLM.
Non-Human Identity management still has a blind spot
Non-human identity management today focuses on discovery, inventory, and credential rotation. This guide covers why runtime authorization is the missing layer, how overprivileged NHIs create risk at scale, and how to enforce fine-grained, policy-based access control for every service-to-service request.
Agent skill for writing authorization policies
Writing authorization policies from a blank file is slow. The Cerbos agent skill handles the drafting for you, asking clarifying questions in plain English before generating a full Cerbos policy bundle with schemas, roles, resource policies, and tests. Works with Claude Code, Cursor, Codex, and more.
How to add authorization to legacy applications without code changes
Learn how to add authorization to legacy applications without modifying a single line of code. This guide covers the gateway pattern with Cerbos Synapse and Envoy, route-level policy enforcement, device posture checks, audit trail coverage, and a phased path from zero visibility to full authorization governance.
Row-level security for Apache Trino, powered by Cerbos Synapse
Add row-level security, column masking, and table-level access control to Apache Trino using Cerbos policies. No Rego, no custom plugins. Covers policy examples, attribute-based filtering from your IdP, per-role masking rules, and compliance audit logging through Cerbos Hub.
Mapping business requirements to authorization policy for utilities
Learn how to write and manage authorization policies for utility companies using PBAC. Compare RBAC vs. ABAC across real-world scenarios like SCADA access control, gas sensor policies, compliance audits, and vendor onboarding - with practical YAML and code examples that reduce downtime, cut costs, and simplify operations.
Policy as Code with Azure API Management and Cerbos
Integrate Cerbos with Azure API Management to externalize API authorization. Deploy Cerbos PDP on Azure Container Apps, enforce RBAC and ABAC at the gateway, validate JWTs, and manage versioned policies independently from backend services for scalable, secure access control.
Cerbos Hub Playground: Recent updates
Explore the latest Cerbos Hub Playground updates, including permission matrices, execution traces, diff views, templates, and sandboxed policy testing to build and debug authorization faster.
Announcing ePDP Rules: Fine-grained control for embedded policy bundles
Learn about ePDP Rules that have been released. Take advantage of fine-grained control over bundle composition and distribution. Deploy policies more broadly while maintaining security and performance.
Mapping business requirements to authorization policy for aviation
A practical guide to authorization in aviation. Learn how to implement RBAC and ABAC to secure flight, maintenance, and ticketing systems with contextual policies, audits, and real-time enforcement.
Migrating from OPA and Rego to Cerbos
Learn how to migrate from from OPA and Rego to Cerbos. This guide walks you through the differences, how to translate common patterns, how to update your integration layer, and how to roll out the migration safely.
Automate Cerbos policy uploads with the cerbos-store-action GitHub Action
Automate your authorization workflows with the new Cerbos Store Action for GitHub. Synchronise your policy files with Cerbos Hub automatically in CI/CD - no manual scripts or Docker commands needed.
Mapping business requirements to authorization policy in HR systems
Best practices for translating business requirements into authorization policy for your Human Resources (HR) system. We walk through the process of reviewing business requirements, analyzing them, defining policies, and ultimately deploying them to production systems as efficiently as possible.
Mapping business requirements to authorization policy for insurance
Explore how insurance companies can combat fraud with modern authorization. This guide explains PBAC in action across auto, life, and property insurance; with practical examples and policy templates to help you implement secure, fraud-resistant access control in your organization.
Run Cerbos natively inside AWS Lambda
Deploy Cerbos directly in AWS Lambda-either as a standalone function or as a lightweight extension layer-while using Cerbos Hub for centralized policy management and audit-logging.
Zero-Trust for microservices, a practical blueprint
Learn how to implement a Zero-Trust security model for microservices. Discover how to secure service-to-service communication, manage workload identities, and enforce fine-grained authorization across distributed systems, AI agents, and APIs.