--- title: "Utility Warehouse" description: "Customer success story: Utility Warehouse synchronizes authorization across 4,500 services" customer: "Utility Warehouse" website: "https://uw.co.uk" canonical: "https://www.cerbos.dev/customers/utility-warehouse" image: "/assets/use-case-files/social/utility-warehouse-case-study-url-thumbnail.png" source: "https://www.cerbos.dev/customers/utility-warehouse" --- # Utility Warehouse synchronizes authorization across 4,500 services An FTSE 250 Index company replaces a cumbersome in-house authorization system with decoupled, centralized authorization management, gaining enhanced reliability and transparency. ## At a glance - Months of developer time reclaimed from boring maintenance - Enhanced reliability and transparency for access control - Eliminated technical debt from authorization > Cerbos has a grammar in their YAMLs that we can trust. What we had before was the wild west. It was thousands of lines of code. > > — Rob Crowe, Principal Engineer, Utility Warehouse ### Summary Utility Warehouse (or UW) is the only genuine multiservice provider in the UK. It offers the cheapest variable energy tariff in the UK and is a constituent of the FTSE 250 Index. It currently handles over 814,000 customer accounts with the help of over 45,000 independent distributors. They have a team of over 200 software engineers and their software runs over internal 4,500 services. Cerbos is an authorization management solution that makes fine-grained access control easy to implement and maintain by decoupling authorization from application silos. When Utility Warehouse used Cerbos to rebuild their internal authorization system, they reclaimed valuable time that would have been spent on maintenance, achieved an enhanced level of reliability and transparency in their access controls, and eliminated a source of technical debt. [Watch the video](https://www.youtube.com/watch?v=KO3WSPVHeLg) ## Introduction ### An in-house authorization system due for an overhaul When you are an FTSE 250 company with a team of 200+ engineers running over 4,500 services, the idea of re-building your in-house authorization system can be highly daunting. For Rob Crowe, the Principal Engineer at Utility Warehouse, it was clear that such a re-build was due. Utility Warehouse’s internal authorization logic was ‘long in the tooth’. Rob knew that there would be trouble down the road if his team didn’t upgrade the system.   **“We’d built an internal authorization software but we hadn’t looked after it. It kind of worked but it was basic and a bit cumbersome,”** he explained. Utility Warehouse had YAML files in a GitHub repository that defined their role-based access control (RBAC) policies. But with 4,500 internal services, managing changes was getting hairy.  “The JWTs were too big to fit in browsers and cookies, so we had to hack around it,” Rob recounts, “We realized that our 200+ engineers were doing their own thing, we didn’t have a standard way of doing authorization, and we had no way of testing our pull requests. If we thought it looked right, we merged it and waited to see if it worked.” As a result of code bloat, lack of standardization, and insufficient visibility, UW was dealing with version control issues as well. **They had many versions and implementations of authorization logic. The policy evaluation logic was scattered across Utility Warehouse’s code base.** > We realized that our 200+ engineers were doing their own thing, we didn’t have a standard way of doing authorization. > > — Rob Crowe, Principal Engineer, Utility Warehouse ## Business Needs ### Security, compliance, and consistency Taking stock of Utility Warehouse’s authorization challenges, alongside the requirements of the business, Rob knew that they needed a centralized, secure, and SOC/ISO-compliant way of managing access control.  **As an FTSE 250 company in a regulated market, they need to be able to track who accesses their systems and why.** So creating a system that was auditable, with automatic logs that are easy to read, would be a great advantage. Centralizing their access control policies in one place would make it easier to enforce security standards. And it would simplify their access logs for easier auditing.  ## Evaluating solutions ### A familiar language and hassle-free implementation Instead of re-building authorization in-house, Rob chose to look for an external tool. 'We could have used our existing tools, but it would've required a lot of investment in something that wasn’t our core business,' he says.  Also in the interest of time, Rob looked for a solution that would fit easily into UW’s existing framework. 'Cerbos is similar to our internal system, with a ton of extra features. It’s open source and written in YAML, which we’re familiar with. It fits with how we think about RBAC and ABAC,' says Rob.  Rob and his team started by implementing a self-hosted, open-source Cerbos Policy Decision Point (PDP). They started small, using Cerbos to authorize just a few of their internal services. Since they didn't need to learn new policy languages or learn new access control concepts, Rob and his team were able to move quickly. They improved their previous authorization, adding additional logic and rules. And they eliminated their previous version control issues and complicated roll-out processes.  'Cerbos has a grammar in their YAMLs that we can trust. Whereas the one we had before was the wild west. It was thousands of lines of code,' Rob says. Using Cerbos, Rob and his team  keep their code clean and simple. And they manage policies through the configuration rather than editing code.  Rob was also pleased to find that Cerbos came with built-in testing and auditing capabilities. 'One of our favorite features is the audit logs because it allows us to understand what is happening in the black box,' he says, 'And we’ve never been able to write tests and validate that changes are taking place. Cerbos allows us to do that.' > One of our favorite features is the audit logs because it allows us to understand what is happening in the black box. We didn’t know we needed that. > > — Rob Crowe, Principal Engineer, Utility Warehouse ## Results ### A more transparent and reliable authorization system requiring minimal upkeep UW’s access control system was in bad shape, but after implementing Cerbos, Rob feels they successfully averted a crisis. “If we had kept our old system for more than 6 months or a year, we would have been in trouble. Cerbos came along with a product that let us bootstrap and move quickly,” he says.  Rob and his team don’t wrangle scattered authorization logic across 4,500 services anymore. Everything is managed and deployed through one decoupled Policy Decision Point. **It takes a few minutes to make changes rather than days rooting out disparate pieces of code.**  Rob and his team also have total visibility into why a user is granted or denied access or permission. **They have comprehensive audit trails that enable Rob to follow the evolution of access policies through time.**   > We have a proper tool to depend on and I trust Cerbos’ workflows. If the green tick says that it is built, then we know it should work. > > — Rob Crowe, Principal Engineer, Utility Warehouse As a result, Rob is more confident than ever before that Utility Warehouse’s authorization logic is accurate and secure. They don’t worry about errors when they apply permissions. Instead, they use the quality control capability within Cerbos to test policies before deployment.  “We have a proper tool to depend on and I trust Cerbos’ workflows. If the green tick says that it is built, then we know it should work,” he says.  Eliminating the massive task of detangling permissions logic, Rob and his team have more time to focus on building UW’s software. **“Cerbos allows our team to focus on getting rid of technical debt and other business use cases instead of wondering how to write a policy evaluation language,”** he explains. Throughout the process of evaluating and implementing Cerbos, Rob also appreciated the expertise, honesty, and willingness to take feedback demonstrated by the Cerbos team. “The Cerbos team is smart, humble, transparent, and nice. Our relationship feels like a partnership, and everything they've built has answered a need for us,” he says, “**It's weird to say an outside company has our back, but Cerbos does.** It's the people. It's their open-source code: it's high quality, you can read it, it does what it says on the tin.” #### Related links - Full interview Rob Crowe - Human Managed creates a future-proof ABAC engine with Cerbos - NTWRK makes a complex access control system easy to manage with Cerbos #### Learn more about Cerbos - Human-readable authorization - Read–eval–print loop (REPL) - Scalability - Audit logs