[#quote#]

[#graysection#]

[#cerboshubctabanner#]

[#video#]

# Introduction

BarrierSystems is a “smart access management solution” for restricted traffic areas in corporate complexes and cities. Their sensor devices recognize vehicle license plates and models, and their web-based software application is used to grant or deny each vehicle access to the controlled area. The software shows the state of all barriers at any given time. Access policies can be programmed to each physical barrier, as well as managed centrally. 

“Cities in Germany and Switzerland have been implementing smart barriers as part of their counter-terrorism initiatives.”, Aaron explains, “They can use our software to restrict access to protected areas to only official vehicles.” 

Different authorization policies are required for the people using and managing the software versus the ones who are controlling the barriers. Corporate security officers at either gate stations and central offices can control access to their private parking garages, and restrict access to loading bays to only pre-approved vehicles. But a gate officer for a restricted area may only need access to one gate, and the gate access policies for the entire city or area should be managed from a central security hub for consistency and observability. 

BarrierSystems has developed organically according to customer needs. New rules and attributes were added over time to their policies until one day the team realized it had become extremely complicated to manage. 

“The scope of this whole thing has expanded over the years because certain customers wanted to have changes in how a role functioned, and they wanted to give certain users permissions, which they usually didn't have in their role. So we were constantly looking for more flexibility in our solution,” said Rafael Morales, ex-Software Engineering Team Lead for BarrierSystems. 
 

# Business needs

- RBAC and ABAC for their claims-based authorization system
- Clear documentation of authorization policies
- Ability to work across the front end and back end

Rafael and Aaron wanted to offer their customers more flexibility in their access policies, and to do that they needed a better way to manage complexity within the security requirements of an access control system. They needed better documentation of their policies and easier management of policy implementation in their software and across each of their client instances. 

One key aspect of their policy logic they needed to accommodate was their “claims” system. “Claims are basically rules that we define in our systems that enable or disable certain privileges for a user. Control over a barrier is one. Allowing users to add permissions that are longer than a specific set of days is another,” explains Aaron. “If a user wants to add a permission that is enabled for a year, then they have to have a specific claim. Otherwise, they would be restricted to permissions that are enabled for hours or days.” 

For BarrierSystems’ customers, access policies are always temporary by default, and location-specific. A vehicle is only allowed to enter during certain time periods, gate officers are only allowed control over the gate during their shift. And admins shouldn’t just be given blanket access to open and close gates just because they are an admin.

In addition to the claims, BarrierSystems also use role-based access control (RBAC). And keeping policies organized and consistent across their front and back end was an ever-growing challenge.

 

[#quote#]

[#graysection#]

# Results

- 75% fewer support tickets related to authorization
- Faster time to market with new features
- Improved scalability

Once Cerbos was implemented, BarrierSystems noticed they received fewer support tickets from customers with permissions issues. The improved clarity and consistency of policies between the front end and the back end eliminated one of their most common user experience hitches. “No news is good news, especially in regards to physical security,” said Rafael.

BarrierSystems is now more confidently able to accommodate customer requests for special claims in their access policies. They are releasing new updates faster because their testing process has become easier and faster with Cerbos’s built-in policy testing features. Seeing simulated API calls that show the authorization decisions made according to each policy, BarrierSystems can ensure all policy changes are secure and compliant with customer requirements.

“ Whenever a new feature is requested by a customer I can just add a simple rule for that exact use case and I don't have to add 20 checks all over the place in the code. I can add the rule and test it to be sure it’s working as intended. It's made the process of manipulating the existing system a lot easier,” said Aaron.

The Cerbos audit logs have also helped BarrierSystems reduce time spent investigating issues. Aaron explains,  ”A year ago, I had to go into the actual code of the software version that was deployed for the customer and had to check in the specific component and try to trigger actions to figure out why a customer wasn’t able to take action or see a button. And now I can just check our audit logs and policy files and do it that way, which is a lot easier.”

In the near future, BarrierSystems plans to scale the Cerbos implementation to support a more sophisticated multi-tenant client setup—something that would have taken over a month of additional development time using their legacy system. While multi-tenancy was possible before, Cerbos has made the implementation faster, more flexible, and easier to maintain—unlocking scalability improvements that position BarrierSystems to support more complex customer needs without increasing engineering overhead.

 

### Related links

- <a href="https://www.barriersystems.de/">Learn more about BarrierSystems</a>
- <a href="https://www.cerbos.dev/features-benefits-and-use-cases/multi-tenant-saas">Learn more about Cerbos for multi-tenant systems</a>

75% fewer support tickets related to authZ

Using Cerbos to manage access policies, BarrierSystems was able to improve user experience and simplify their own policy management workflows to enable consistent and reliable access control for their customers.

BarrierSystems integrates Cerbos into smart vehicle access gates, cutting internal costs by 15%

BarrierSystems

Our existing structure was inconsistent, making it difficult to track and manage permissions across diverse customer needs. We needed a system that offered both clarity and scalability.

It was very hard to have an actual overview of which claims allow you to do certain tasks or what tasks are restricted by certain claims. And you'd have to go through the code in the front end and the back end, which usually wasn't consistent, just to figure out why a certain user can’t press a button.

Success story

BarrierSystems integrates Cerbos into smart vehicle access gates, cutting internal costs by 15%