--- title: "9fin" description: "Customer success story: 9fin modifies product packaging in 10 minutes with Cerbos" customer: "9fin" website: "https://9fin.com/" canonical: "https://www.cerbos.dev/customers/9fin" image: "/assets/success-story-images/customer-9fin-preview.png" source: "https://www.cerbos.dev/customers/9fin" --- # 9fin modifies product packaging in 10 minutes A finance data platform serving top 10 investment firms reclaims their time, prevents future technical debt, and gets features to market faster by implementing authorization rules with Cerbos. ## At a glance - Reduced hours of developer time to 10 minutes - Eliminated technical debt from authorization - Accelerated feature development and time to market > We can keep adding rules, without bloating and creating spaghetti code. I struggle to think of requirements that can’t be expressed in the Cerbos policy format. > > — Joe Qureshi, Senior Software Engineer, 9fin ### Summary 9fin is a leveraged finance data platform providing news, analysis, metadata, pricing, and more for the debt capital markets. The platform centralizes everything needed to analyze a credit, or win a mandate in one place - helping subscribers win business, outperform their peers and save time. It is used by investment banks, law firms, hedge funds, and asset management firms in the US, UK, and EU markets. Cerbos is an access control solution helping developers implement and manage authorization policies in a fraction of the time they’d spend doing it in-house. 9fin uses Cerbos to manage their product packaging, tailoring access to features and resources for their clients according to the business type. ## Introduction ### “The mechanism used to package features is not a core competency.” 9fin’s engineering team was familiar with the potential hazards involved with building permission systems. They had a good idea of what they didn’t want to happen. **Managing home-built access controls can become a significant drain on time and mental bandwidth. And it can pull focus away from core features that drive business value.** From their perspective, the mechanism used to package features is not a core competency. The actual features being packaged by that mechanism are what drive business value and deserve their full focus. So looking outside for an access control solution was an obvious choice. However, there is a “Goldilocks zone” of compatibility when it comes to implementing outside frameworks. The solution can’t be too structured that it doesn’t fit into the existing software, but if it’s not structured enough it doesn’t add much value. “Frameworks that aren’t opinionated at all tend to lead to chaos,” says Joe Qureshi, Senior Software Engineer at 9fin, “And the ones that are tend to run into the ‘unsupported pattern’ problem quickly.” An access control system that fits in the Goldilocks zone would be structured enough to remove the burden of having to build and maintain the logic as code, but flexible enough to integrate seamlessly into their existing architecture. Learn more about the product packaging use case for Cerbos ## Requirements ### Fine-grained, clearly codified, and strictly controlled The mechanism to control product packaging may not be a core competency to 9fin engineers, but it is a core security requirement. **As a fintech platform, one of 9fin’s chief concerns is compliance.** So the mechanism that controls who accesses which resources needs to be clearly codified, strictly controlled, and auditable. Next, **they need to be able to change or customize features and product packaging easily, without compromising their strict security standards.** 9fin serves 9 out of 10 of the top investment banks, and some of the world’s most prestigious law firms, which have some overlapping needs and some needs that are specific to their business type. In some special cases, they may want to override permissions for a particular feature or create policies that account for multiple conditions required to access resources and subsets of resources. ### Evaluating Cerbos: A developer-focused solution The engineers were already familiar with the concepts of RBAC and ABAC and were aware of several companies that could provide a solution. Joe and the team started their exploration of Cerbos with the documentation, like any developers would. He liked that the information was clear. He was quickly convinced that from a technical perspective Cerbos could handle complex requirements. It encouraged him to play around with the product beyond just reading the docs. Further into the process, Joe had a few conversations with the Cerbos team. They were able to share technical advice on how to address Joe’s use case, and give suggestions on how to model 9fin’s policies. Joe values the fact that he’s still very much in the driver’s seat when using Cerbos. 'The fact that Cerbos is open source and therefore isn’t a black box is great. We have the fallback option to look at the code and reason about behaviour ourselves,' says Joe, 'We write and maintain policies in our repositories so we retain a sense of ownership.' > The fact that Cerbos is open source and therefore isn’t a black box is great. We write and maintain policies in our repositories so we retain a sense of ownership. > > — Joe Qureshi, Senior Software Engineer, 9fin ## Results ### Progressive complexity for feature packaging with minimal time commitment Joe implemented simple policies with Cerbos at first, and was happy about how quickly he was able to make it useful to the product. **“There was a very low bar to get going and start shipping,” he says, “Cerbos has a pattern of having a single microservice so that we could gradually roll out the rules to other services beyond the main web app.”** As Joe began adding more complex policies and editing product packaging, he found the process to be clear-cut and simple. **Changing product packages took him 10 minutes, when he would have otherwise expected it to take hours.** “The way Cerbos policies are designed allows us to keep adding rules, without bloating and creating spaghetti code,” he explains. “I can quickly and confidently change rules on policies. And I struggle to think of requirements that can’t be expressed in the policy format Cerbos has developed” As a bonus, Joe shares that using Cerbos has helped the business side and product side teams communicate more effectively. “It helped form a language to illustrate requirement complexity to the non-technical stakeholders of projects,” he says. The mechanism to control feature packaging may not be a core competency, but since using Cerbos, it’s something they can do really well without having to spend too much time on it. Plus, **having the freedom and flexibility to change and customize product packaging means that 9fin can get features to market faster** and respond to client requests faster. All they need is 10 minutes. And then they go back to building new features and growing the business. > There was a very low bar to get going and start shipping. Cerbos has a pattern of having a single microservice so that we could gradually roll out the rules to other services beyond the main web app. > > — Joe Qureshi, Senior Software Engineer, 9fin #### Related links - Human Managed creates a future-proof ABAC engine - Debite accelerates compliance certification and ships products faster #### Learn more about Cerbos - Product packaging with Cerbos - Ecosystem - Human-readable authorization - Decoupled authorization - Flexible deployment with low-latency