[#quote#]

[#graysection#]
[#cerboshubctabanner#]

# Introduction

Utility Warehouse (UW), a FTSE 250-listed company, delivers bundled utilities - energy, broadband, mobile, insurance - to over 814,000 UK households. Behind the scenes, over 4,500 internal services coordinate millions of actions each day, driven by 1.5 million customers, 2,500 employees, 40,000 partners, and thousands of internal workloads.

Each of these interactions by an end user triggers a cascade of non-human identities calling services, API clients invoking workflows, and workloads making downstream decisions on behalf of the user. UW recognized that its perimeter-based, legacy authorization approach was no longer sufficient.

“We had no idea what our services were doing on behalf of users. Once a request passed the edge, the identity and the intent got lost. It wasn’t just about who the user was anymore, but what the system was doing for them. And we had zero visibility or control over that,” said Rob Crowe, Principal Engineer at Utility Warehouse.

That changed when UW adopted Cerbos in 2021 to centralize and standardize access decisions across its entire identity landscape - human and machine. With context-aware, identity-propagating authorization, UW transitioned to a true Zero Trust architecture - one that protects every identity, in every system, whether it’s in-house, third-party, or legacy.
 

# Building a true Zero Trust Architecture

UW’s previous security model relied heavily on perimeter-based controls. Once a request passed through the edge gateway or firewall, it was trusted implicitly. But in a distributed architecture with over 4,500 internal services and thousands of non-human identities, that approach couldn’t keep up. As their microservice environment grew, so did the risk - services could talk to each other freely, often without revalidating intent or identity. That created a dangerous blind spot. With Cerbos, UW adopted a Zero Trust architecture, where no request is trusted by default, and every service enforces its access control policies, regardless of where the request originated. The authorization layer runs as a distributed service that does a check on each service innovation, making fine-grained, context-aware authorization decisions based on both the immediate caller and the original end user, preserving the full call chain and intent.

As one of the UK’s largest consumer platforms, UW operates at a scale where implicit trust simply doesn’t hold up. Like many regulated businesses, it treats Zero Trust as a foundational requirement, aligned with frameworks like NIST SP 800-207 and the OWASP Top 10. Zero Trust principles are essential for UW for several reasons:

- High service volume and call depth. With thousands of internal services, even a single user interaction can trigger dozens of service-to-service calls. Without Zero Trust, any compromised node becomes a pivot point for lateral movement.
- Mixed identity landscape. UW handles access for workforce users, customers, partners, and machine identities—each with different trust boundaries and permissions.
- Regulatory and audit requirements. As a regulated business, UW must maintain tight control over access and demonstrate compliance through clear, traceable logs.
- Evolving threat models. With attackers targeting internal systems via compromised services or misconfigured permissions, enforcing trust at the edge is no longer enough.
 

[#quote#]
 

# Managing NHIs at scale. Fast, context-aware

UW uses Cerbos to manage access for a wide range of identities:

- 1.5 million customers
- 40,000 partners
- 2,500 workforce users
- 4,500 internal services and workloads

But these raw numbers don’t reflect the true complexity of their environment.

Each user action can ripple through dozens of internal services, and at every step, Cerbos authorizes both the immediate caller and the original end user. That context must be preserved and evaluated with each request.

This creates millions of non-human identity (NHI) access decisions per day - a volume that would overwhelm most systems. But not Cerbos.
“The number of NHIs we authorize isn’t just the number of services - it’s that, multiplied by the number of users, multiplied again by the call depth. Cerbos is the only thing that makes that manageable,” said Rob.

Thanks to its stateless architecture and fast decision engine, Cerbos handles millions of access decisions with millisecond-level latency, even under heavy load. Whether embedded directly or deployed as a central PDP, Cerbos delivers consistent, low-latency responses that don’t slow down the system.

“We rely on Cerbos to make authorization decisions across the whole mesh - millions of times a day. And it’s fast. We don’t even think about it anymore. It just works,” highlighted Rob.
What makes this scale possible is Cerbos’ impersonation-aware authorization. As requests travel across services, the original caller’s identity and intent are preserved and evaluated at every step. That way, each service in the chain enforces policy not just on what is being done, but on whose behalf.

This enables UW to enforce least privilege across NHIs with full context, without compromising performance or developer velocity.
 

# Observability and security at a new level

Before Cerbos, UW had limited insight into how permissions were being granted, or abused. Authorization decisions were opaque, fragmented across services, and impossible to trace.

Now, every Cerbos decision is automatically logged and streamed into their observability pipeline and SIEM platform, giving their security teams a powerful new layer of visibility and control. 

“Cerbos audit logs changed how we do security. We can trace every permission, investigate suspicious behavior, and answer tough questions about who did what, when, and why. We’ve gone from guesswork to forensic-level auditing—across humans, machines, and everything in between,” shared Rob.

With Cerbos audit logs in place, UW can follow every access decision end-to-end, detect anomalies in real time, and ensure compliance across all systems. This level of observability doesn’t just strengthen UW’s security posture; it makes Zero Trust actionable.
 

# Stateless ABAC. Built for distributed systems

UW runs one of the most sophisticated microservice architectures in the UK consumer space. With over 4,500 services, a wide mix of containerized workloads, event-driven systems, and external integrations, their environment is highly decentralized and constantly evolving.

Each service is deployed independently using container orchestration (primarily Kubernetes), with internal communication via efficient gRPC calls. Authorization decisions must happen fast, and most importantly, locally.

For UW, a stateful authorization system—one that caches identity chains, tracks user sessions, or requires coordination between PDP nodes—was a non-starter.
 

[#quote#]

 

Cerbos’s stateless, Attribute-Based Access Control (ABAC) model proved to be a perfect fit:

- Stateless, per-request evaluation with no persistent memory or coordination overhead
- Policies written in YAML, versioned in Git, and easily integrated into their existing CI/CD workflows
- Evaluations are context-aware and support impersonation, delegation, and service-to-service authorization Deterministic performance, even at scale, no matter how many services or identities are involved
- Easy integration with existing tooling like API gateways, Kubernetes sidecars, gRPC interceptors, and application-level middleware

Because Cerbos is lightweight and self-contained, UW was able to adopt and extend it to fit their architecture and make authorization checks via a simple gRPC API with minimal code changes. Teams could incrementally migrate services to Cerbos without re-architecting or introducing latency bottlenecks.

“Cerbos dropped right into our stack. We didn’t need to rewrite anything or rethink how we deploy. It just worked—out of the box,” said Rob.

This architectural fit was crucial. It allowed UW to move quickly from prototype to full rollout, applying fine-grained, testable policies across the entire service fleet without slowing down development or risking stability.
 

# Extending policy control to legacy and off-the-shelf applications

As UW matured its approach to authorization, it recognized an opportunity: apply the same level of control and visibility not just to microservices, but also to commercial, off-the-shelf (COTS) software, open source solutions, and legacy systems.

Many of these systems weren’t originally designed with external policy enforcement in mind. But rather than settling for inconsistent controls or creating one-off solutions, UW implemented a Cerbos proxy layer - a lightweight integration pattern that brings modern authorization capabilities to any application, regardless of age or architecture.

This approach allows UW to:

- Enforce Cerbos policies consistently across in-house and third-party systems
- Gain observability into access decisions in systems that traditionally lacked audit trails
- Unify access management under a single policy model, reducing complexity and risk

 

[#quote#]
 

By applying Cerbos policies at the edge of these applications—via sidecars, API gateways, or reverse proxies - UW brings them into its broader Zero Trust and observability strategy.

It's a powerful example of how organizations can modernize access control without rewriting or replacing existing systems.

This emerging use case highlights the flexibility of Cerbos and positions UW as a leader in next-generation access governance, bridging the gap between legacy systems and modern security expectations.

 

# Results

- NHI access secured at every hop, not just the perimeter
- User identity propagated throughout the service chain for full-context authorization
- Stateless, scalable policies powering 4,500+ services
- Integrated audit logging driving observability and threat detection
- Months of dev time reclaimed by replacing scattered access logic with Cerbos PDP

 

### Related links

- <a href="https://uw.co.uk/">Learn more about Utility Warehouse</a>
- <a href="https://www.cerbos.dev/features-benefits-and-use-cases/authorization-non-human-identities">Learn more about Cerbos for NHIs</a>

NHI access secured at every hop, not just the perimeter

User identity propagated throughout the service chain for full-context authZ

Months of dev time reclaimed through replacing scattered access logic with Cerbos PDP

Integrated audit logging driving observability and threat detection

Using Cerbos, Utility Warehouse secured millions of non-human identity access decisions across thousands of services, moved to a Zero Trust model, and gained full visibility into every request - enabling scalable, observable, and consistent authorization across legacy systems, microservices, and third-party tools.

How Cerbos gave Utility Warehouse control over 4,500 services and millions of NHIs

We had no idea what our services were doing on behalf of users. Once a request passed the edge, the identity and the intent got lost. It wasn’t just about who the user was anymore, but what the system was doing for them. And we had zero visibility or control over that.

Cerbos helped us kill the idea of the firewall as a perimeter. Every service is now its own gatekeeper—and we finally have the tools to enforce that securely.

We needed something that wouldn’t fall over under scale. Stateful systems just don’t work when every service needs to make real-time decisions. Cerbos’ stateless design nailed it.

Even our legacy apps now follow the same access rules as our microservices. Cerbos gives us one model to rule them all - whether it’s new code or old vendors.

Success story

How Cerbos gave Utility Warehouse control over 4,500 services and millions of NHIs