Guide
All articles tagged Guide.
Mapping business requirements to authorization policy for gaming
Mapping business requirements to authorization policy for gaming, with three worked examples covering player profiles and inventory, virtual asset trading, and moderation actions. Each starts with the business rule and ends with a working Cerbos policy, including derived roles, ABAC conditions, and test cases you can run yourself.
Cerbos security and trust: Data handling, certifications, and deployment isolation
How Cerbos handles your data, where it lives, and what leaves your network. A security and trust overview for CISOs and security teams evaluating Cerbos, covering the stateless PDP, deployment isolation, local field masking, certifications, penetration testing, and the Cerbos Trust Center.
Framework for evaluating authorization providers and solutions
In this guide, we provide a framework for evaluating authorization providers and solutions, tailored to the priorities of enterprise decision-makers. We cover all the key criteria - from integration and performance to admin experience and compliance, and back them with data, industry research, and success metrics.
Best OpenZiti alternatives
Picking an OpenZiti alternative depends on the layer you need to replace. Compare ZTNA and overlay networking, self-hosted identity providers, OAuth2 and OIDC token services, and reverse proxy login gateways, plus where Cerbos handles fine-grained authorization once identity and connectivity are already solved.
Your IdP proves who an AI agent is. DORA expects you to control what it does
Your IdP proves who an AI agent is. DORA also expects you to control what it can do at runtime, which is authorization, not authentication. This guide covers where agents fall into DORA scope, how runtime authorization maps to Article 9 and audit requirements, and the steps to take while agents are still early.
Authentik vs Zitadel for authentication
Compare Authentik and Zitadel for authentication. Decide faster across SSO, MFA, proxy mode, LDAP, multi-tenancy, deployment, operations, and where Cerbos authorization fits.
You have Keycloak. What authorization capabilities do you still need?
Keycloak authentication and Keycloak SSO handle identity well. Authorization at scale is a different problem. Here's where the gap appears and how to fix it.
Claude Fable 5 and GPT-5.6 Sol authorization refusals
The models that refuse legitimate security work will also run destructive commands without asking. Both are reasons to enforce authorization outside the agent, not in its prompt.
Agent skill for writing authorization policies in VSCode
A practical guide to writing authorization policies in VSCode using GitHub Copilot agent mode and the Cerbos policy skill. Covers install, the gh skill CLI, chat.agentSkillsLocations, file-scoped *.instructions.md, a typical drafting session, and how validation runs in the integrated terminal.
Agent skill for writing authorization policies in Cursor
Cursor's composer makes it a strong fit for authorization policy work. This guide walks through installing the Cerbos policy skill in Cursor, describing access rules in plain English, letting the composer pull schemas and derived roles into context, validating against the real compiler in the integrated terminal, and producing a complete policy bundle.
Authorization in microservices: Patterns, pitfalls, and how to scale it
Authorization in microservices explained. Why it is harder than a monolith, where it gets enforced, the three patterns for handling authorization data, choosing RBAC or ABAC, service-to-service authorization, and the externalized policy decision point pattern that scales across services without scattered checks or redeploys.
Ory vs SuperTokens for authentication
Ory Hydra and SuperTokens solve different authentication problems. Compare OAuth2 and OIDC token infrastructure against fast product login and session handling, and see where Cerbos fits as the authorization layer after authentication.
RBAC vs ABAC - Which is better for your use case?
A practical RBAC vs ABAC guide covering what each model is, the key differences, whether ABAC is more secure, role explosion, when to use RBAC or ABAC, and how to combine them in one set of policies instead of choosing between them.
The incident response workflow that decides how fast you recover
A step-by-step incident response workflow for the authorization layer, from mapping a compromised identity's blast radius to proving containment held. Covers how centralized policy and decision logs compress each phase, what makes the workflow feasible in regulated and air-gapped environments, and how AI agents change the runbook.
Agent skill for writing authorization policies in Codex CLI
A practical guide to writing authorization policies in Codex CLI using the Cerbos policy skill. Covers cross-agent installer setup, $cerbos-policy invocation, the /skills list command, a typical drafting session, validation against the real Cerbos compiler in Docker, and composing the skill with AGENTS.md.
ABAC examples: Real attribute-based access control policies and use cases
A practical guide to attribute-based access control with real ABAC examples and policy code. Covers the four attribute types, industry use cases, how to write your own ABAC policy, the trade-offs, and where ABAC is heading for Zero Trust and AI agents.
You have Auth0. What authorization capabilities do you still need?
Auth0 covers authentication, but authorization capabilities like resource-level ABAC, per-tenant policies, and decision audit logs sit outside its model. This guide covers where Auth0 RBAC and Auth0 FGA stop, five signals you need a dedicated authorization layer, and how to evaluate solutions and run a POC.
What is fine-grained authorization?
Fine-grained authorization explained. Learn how fine-grained access control uses attributes and conditions to decide access per resource and action, how it differs from coarse-grained control, the RBAC, ABAC and PBAC models behind it, real use cases, and how to implement it without building your own engine.