[#quote#] [#graysection#] [#cerboshubctabanner#] [#video#] # Use Case ## Flexiblity to customize product packaging The Human Managed platform makes APIs available to users according to their subscription type. The product package a given user purchases may include one API or three or five. It might sound straightforward at first, but keep reading. “The rules and permissions are generally controlled based on the use cases that are marketed by the company,” says Je Sum Yip, Chief Engineer, “For example, we may have a role called IT administrator and this role has access to APIs 1, 2, 3, and 7.” Put another way, a business decision-maker would put together a package of products for a targeted persona and use case, which would get translated into a role and an access control policy to be implemented by engineering. This approach leaves little room for flexibility and iteration. “We used to have to write in the source code, ‘If a user is part of this organization, and requesting data from this API, and so on and so on, then allow,’” Je Sum shares, **“Every time we had to change permissions, we would have to go into the source code of the API, make that change, and then recompile, push it out into dev, test it, then push it out into production. It was a real pain.”** Human Managed needed a solution that would give engineering the flexibility they needed to support business needs.

# Requirements ## A “single source of truth” for fine-grained permissions. In order to achieve the flexibility they needed, Je Sum first had to contend with another issue. Their authorization needed to pull information from Okta, their Azure Active Directory, and Auth0 in order to **account for internal users and external users at different stages of the buyer journey.** Je Sum essentially needed to build a “single source of truth” for access controls. Additionally, Je Sum needed their authorization solution to be both fine-grained and simple to manage so that he could **deliver business value without adding complexity to the engineering workload.** “The story actually started off with us using the traditional RBAC model. But in a lot of the discussions that I had with our CTO, we knew that we would reach the limits of RBAC very, very quickly,” says Je Sum.

[#graysection#] [#quote#] # Results ## “A single binary that just works” Where Je Sum used to spend hours or days changing source code every time business needs changed, now he says **it’s as easy as turning a subscription on or off.** “It's literally a single binary that just works. I don't have a dependency against six databases in the backend and a middleware that I need to worry about and some caching layer...None of that. And since I've deployed it, I think that was around... Five months ago? I've never had to go back and look at it.” Je Sum says. So how exactly does Cerbos work with the Human Managed platform? Je Sum explains the new flow now that they've decoupled their authorization from their main code base. “There is a user who logs into the web app, user gets a JWT token. That token contains information about who the user is, what they're supposed to do, and so on. That information is extended via some metadata that is stored in the backend database, which the API will fetch. Once the API has fetched all that, it builds a request, sends it to Cerbos, and Cerbos just returns a true or false. That's it.”

[#quote#] On top of cleaning up his code, **Je Sum has reclaimed precious time for the rest of his team.**

“Having to modify authorization is a five-minute job now. Having to troubleshoot authorization is a five-minute job. So that has actually allowed the team to spend more time where it really matters on the platform, such as building the web UI worrying about the data that gets processed in the background, talking to the customers, et cetera, et cetera.” For engineers looking into Cerbos as a possible solution, Je-Sum’s advice is to leave all assumptions behind. “You sort of look at Cerbos and go, ‘Are you sure you can do this? It's a single binary and you just link it up to Git and that's it? Is it really that powerful?’ And when you actually get down to doing it, you realize that, yeah, it is. And that's the beauty of it.” ### Related links - Full interview with Je Sum Yip - 9fin modifies product packaging in 10 minutes - Utility Warehouse synchronizes authorization across 4,500 services ### Learn more about Cerbos - Product packaging with Cerbos - ABAC (Attribute-based access control) - Flexible policy conditions powered by Google CEL

Success story

Human Managed creates a future-proof ABAC engine with Cerbos