--- title: "Human Managed" description: "Customer success story: Human Managed creates a future-proof ABAC engine with Cerbos" customer: "Human Managed" website: "https://www.humanmanaged.com" canonical: "https://www.cerbos.dev/customers/human-managed" image: "/assets/use-case-files/social/human-managed-case-study-url-thumbnail.png" source: "https://www.cerbos.dev/customers/human-managed" --- # Human Managed creates a future-proof ABAC engine with Cerbos A sophisticated intelligence platform builds fine-grained access control policies to deliver flexible, customizable product packaging to their customers. ## At a glance - Days-long coding task reduced to 5 minutes - Dependencies and middleware replaced with a single binary - Enhanced flexibility to customize services > We can make unlimited conditions, attributes, parameters to any granularity level without writing any code. It allows us to deliver truly personalized services quickly, securely & at scale. > > — Karen Kim, CEO, Human Managed ### Summary Human Managed is an Intelligence Decision Action (IDEA) platform. The platform generates intelligence and recommends action items based on a business’s internal data. Their services cover essential areas such as cyber security, risk management, and digital maturity. Companies using Human Managed access individual services on the Human Managed platform according to their subscription plan. Human Manged delivers each product to the user’s account via APIs. Cerbos is a plug-and-play authorization service for developer, product, and security teams. Human Managed used Cerbos to centralize different sources of user and access control information into one decoupled decision point, instead of connecting every system to their main application. As a result, their code base is cleaner and they can easily modify product packaging for their users as needed. [Watch the video](https://www.youtube.com/watch?v=jwoLLHYC4ws) ## Use Case ### Flexiblity to customize product packaging The Human Managed platform makes APIs available to users according to their subscription type. The product package a given user purchases may include one API or three or five. It might sound straightforward at first, but keep reading. “The rules and permissions are generally controlled based on the use cases that are marketed by the company,” says Je Sum Yip, Chief Engineer, “For example, we may have a role called IT administrator and this role has access to APIs 1, 2, 3, and 7.” Put another way, a business decision-maker would put together a package of products for a targeted persona and use case, which would get translated into a role and an access control policy to be implemented by engineering. This approach leaves little room for flexibility and iteration. “We used to have to write in the source code, ‘If a user is part of this organization, and requesting data from this API, and so on and so on, then allow,’” Je Sum shares, **“Every time we had to change permissions, we would have to go into the source code of the API, make that change, and then recompile, push it out into dev, test it, then push it out into production. It was a real pain.”** Human Managed needed a solution that would give engineering the flexibility they needed to support business needs. ## Requirements ### A “single source of truth” for fine-grained permissions. In order to achieve the flexibility they needed, Je Sum first had to contend with another issue. Their authorization needed to pull information from Okta, their Azure Active Directory, and Auth0 in order to **account for internal users and external users at different stages of the buyer journey.** Je Sum essentially needed to build a “single source of truth” for access controls. Additionally, Je Sum needed their authorization solution to be both fine-grained and simple to manage so that he could **deliver business value without adding complexity to the engineering workload.** “The story actually started off with us using the traditional RBAC model. But in a lot of the discussions that I had with our CTO, we knew that we would reach the limits of RBAC very, very quickly,” says Je Sum. ### Evaluation: A balance of simplicity and flexibility Around the same time Je Sum started looking into Cerbos, he also tried building his own ABAC engine from scratch. 'I quickly realized that it's an engineering task that's way too expensive for us. It's not worth my time to go build it,' he says.  For the level of complexity he needed, Je Sum said he found Cerbos surprisingly easy to work with. He was able to pass data from his Hubspot, AzureAD, and Auth0 tokens to a single Cerbos Policy Decision Point (PDP), and connect that single PDP to the Human Managed platform. That way, **authorization for each API within the product only requires one request to the PDP instead of a request to each different system.**  He wrote his policies to be resource-centric (each resource being an API) rather than role-centric to simplify the logic of who has access to each product within the platform. And while it wasn’t worth his time to build an ABAC engine on his own, **Je Sum was able to get Cerbos into production in about two weeks worth of time.**  'Writing the policies, setting up Cerbos with our CD pipeline, which involves writing all the manifests and all the rest of the stuff that we need to have this managed by Argo CD. All the DNS entries, all the rest of the infrastructure stuff…write a wrapper library around Cerbos, expose that via the API framework that we have. And all the usual testing, making sure it works and all that…took about two weeks to put it into production and we're very pleased with the results.' Je Sum reports. > It is so straightforward to deploy. There's so many things we can do with it. This is future-proofing our ABAC engine > > — Je Sum Yip, Chief Engineer, Human Managed ## Results ### “A single binary that just works” Where Je Sum used to spend hours or days changing source code every time business needs changed, now he says **it’s as easy as turning a subscription on or off.**  “It's literally a single binary that just works. I don't have a dependency against six databases in the backend and a middleware that I need to worry about and some caching layer...None of that. And since I've deployed it, I think that was around... Five months ago? I've never had to go back and look at it.” Je Sum says.  So how exactly does Cerbos work with the Human Managed platform? Je Sum explains the new flow now that they've decoupled their authorization from their main code base.  “There is a user who logs into the web app, user gets a JWT token. That token contains information about who the user is, what they're supposed to do, and so on. That information is extended via some metadata that is stored in the backend database, which the API will fetch. Once the API has fetched all that, it builds a request, sends it to Cerbos, and Cerbos just returns a true or false. That's it.”  > Having to modify authorization is a five-minute job now. Having to troubleshoot authorization is a five-minute job. So that has actually allowed the team to spend more time where it really matters on the platform > > — Je Sum Yip, Chief Engineer, Human Managed On top of cleaning up his code, **Je Sum has reclaimed precious time for the rest of his team.** “Having to modify authorization is a five-minute job now. Having to troubleshoot authorization is a five-minute job. So that has actually allowed the team to spend more time where it really matters on the platform, such as building the web UI worrying about the data that gets processed in the background, talking to the customers, et cetera, et cetera.” For engineers looking into Cerbos as a possible solution, Je-Sum’s advice is to leave all assumptions behind. “You sort of look at Cerbos and go, ‘Are you sure you can do this? It's a single binary and you just link it up to Git and that's it? Is it really that powerful?’ And when you actually get down to doing it, you realize that, yeah, it is. And that's the beauty of it.”  #### Related links - Full interview with Je Sum Yip - 9fin modifies product packaging in 10 minutes - Utility Warehouse synchronizes authorization across 4,500 services #### Learn more about Cerbos - Product packaging with Cerbos - ABAC (Attribute-based access control) - Flexible policy conditions powered by Google CEL