Guide
All articles tagged Guide.
Choosing the right deployment model for enterprise authorization
Understand the deployment models available for your authorization system - cloud hosted, self hosted, on premise. See what drives the choice between them, and what each one means for your team in practice.
The Meta AI hack shows why agents shouldn't decide access
AI agent authorization broke wide open when hackers talked Meta's support chatbot into resetting Instagram passwords. This breaks down the confused deputy problem, why authentication alone doesn't fix it, and why access decisions belong in externalized authorization the agent can't argue its way past.
Agent skill for writing authorization policies in Claude Code
Claude Code lets engineers draft authorization policies in plain English, right in the terminal. This guide covers installing the policy skill through the plugin marketplace, invoking it with /cerbos-policy, what a session looks like, validating against the real Cerbos compiler in Docker, and where human review still matters.
Authorization for AI agents: What to build before the EU AI Act deadline
What runtime policy at the orchestration layer means, why the agent-to-tool layer is the missing category in agentic AI governance, and which EU AI Act articles actually apply to infrastructure vendors. Practical steps for CTOs and security leads on inventorying agents, sponsoring identities, and externalizing authorization.
Authentik vs Keycloak: Self-hosted IdP comparison
Compare Authentik and Keycloak for self-hosted IAM. See SSO, MFA, protocol support, operations, authorization limits, and where Cerbos fits.
Mapping business requirements to authorization policy for automotive
Authorization in enterprise automotive platforms covers more than roles. This guide explains why RBAC fails for software-defined vehicles, how ABAC and policy-as-code govern OTA updates, ECU diagnostics, and supplier access, and how Cerbos handles workforce, partner, customer, and non-human identities across the vehicle lifecycle.
Fine-grained authorization for AI gateways
Fine-grained authorization for AI gateways, explained. Why gateway authentication stops short of access control, how attribute-based policies govern model calls, tool invocations, MCP methods, and agent-to-agent delegation, and how Cerbos provides the runtime policy layer for every AI request.
EIC 2026: Stop counting agents, protect what they can touch
AI agent authorization was the question every IAM team brought to EIC 2026. Inventory tells you which agents exist. It does not decide whether an agent should move money, call a tool, or act through a delegated user. Notes on the vault, delegation chains, dynamic authorization, and EU AI Act audit.
Agent skill for writing authorization policies in Claude Desktop
Claude Desktop lets product, security, and engineering leads draft Cerbos authorization policies in plain English without writing YAML. This guide walks through installing the Cerbos policy skill, connecting your specs via MCP, validating against the real compiler, and producing a complete policy bundle ready for review and PR.
Identity security in 2026
Identity security explained. The pillars most vendors cover (authentication, IGA, PAM, ITDR, ISPM, identity fabric), the shift to machine and AI agent identities, and the runtime authorization layer where most identity security programs still have a blind spot.
EIC 2026 takeaways: the identity stack built for humans will not hold up for AI agents
The identity stack built for humans does not hold up for AI agents and ephemeral workloads. Takeaways from EIC 2026 on signal-driven authorization, action-based provisioning, delegation chains, token issuer risk, and the four questions every CISO should ask about agent identity in the next 12 months.
Query plan adapter for Elasticsearch (Java)
Externalized authorization with Cerbos. Translate policies into native Elasticsearch Query DSL using the PlanResources API. Push access control to the database layer, avoid post-fetch filtering, and scale secure search with nested query support and operator overrides.
Already have authentication? Here's the authorization layer you still need.
Identity providers cover authentication, not fine-grained access control. See the authorization gaps they leave and how to evaluate a solution.
How much does it cost to build authorization in-house?
The cost of building authorization in-house often runs into seven figures. This guide breaks down real numbers from Salesroom, Debite, Loop, and 4G Capital, plus the hidden costs of maintenance, compliance, and diverted developer time that most teams forget to estimate upfront.
Integrating Cerbos with Kong: A how-to guide for API gateway authorization
Learn how to integrate Cerbos with Kong to offload authorization decisions from your services and centralize policy enforcement at the gateway. This hands-on guide walks through a real setup using Docker Compose, custom plugins, and fine-grained access policies to secure every API request.
Tokens are authorization decisions: a guide to policy-driven token issuance
Tokens are authorization decisions, and most identity teams don't manage them like one. This article explains policy-driven token issuance, the three patterns Gartner calls Authorization Management Platforms, what AuthZEN changes, and how to govern AI agent tokens without hardcoding logic into the IdP.
Query plan adapter for Convex
Externalized authorization with Cerbos moves access control into policy files and pushes filtering to the data layer. Learn how the PlanResources API and a new Convex adapter generate efficient, secure queries without row-by-row checks.
What is a Runtime Authorization Platform
Runtime Authorization Platforms explained. What runtime authorization actually means, how it differs from admin-time and event-time controls, why attacks land on the runtime layer, and what separates a real runtime platform from a policy engine. Covers architecture, deployment shapes, AuthZEN, and continuous evaluation.