Context sources

Connect any data store to the authorization pipeline

Data source extensions are reusable connectors that retrieve data from external systems — databases, APIs, identity providers — and make it available to other Cerbos extensions with built-in caching.

Reusable connectors

Define a data source once and reuse it across route, proxy, and Envoy extensions — changes to schemas or connections are handled in one place

Cached responses

In-memory or Redis-backed caching with configurable TTLs reduces latency and load on upstream systems

Built-in and custom

Built-in support for PostgreSQL, MySQL, and SQLite — custom extensions connect to any data store

How Cerbos works with Data Source Extensions

Authorization decisions are only as good as the data behind them. Data Source Extensions provides real-time context (user profiles, group memberships, or external attributes) that makes Cerbos policies richer and more accurate.

Cerbos lets you write fine-grained, context-aware authorization policies in human-readable YAML. With Data Source Extensions as a context source, those policies can evaluate attributes beyond what's in the initial request.

Because enrichment happens at the policy layer, your application code stays clean, no custom plumbing to fetch and merge identity data before making authorization calls.

Policy-as-codeHuman-readable YAML policies managed like source code Scalable PDPStateless policy decision point with sub-millisecond latency Centralized managementManage, test, and deploy policies from a single control plane

Centralized data source management

Authorization decisions depend on data from many systems — identity providers, databases, internal services. Without a centralized approach, data-fetching logic ends up scattered across applications, tightly coupled to upstream schemas, and duplicated across teams.

Data source extensions are a core component of Cerbos Synapse, the data integration and enrichment layer that sits in front of the Cerbos PDP. They define connections to external systems once, and other Synapse components — proxy extensions, route extensions, and Envoy extensions — all call the same data sources to retrieve context for authorization decisions.

How data source extensions work

Configure a data source — either a built-in connector (PostgreSQL, MySQL, SQLite) or a custom extension for any data store.
Other extensions call the data source to retrieve context during authorization evaluation.
Results are cached with configurable TTLs using an in-memory or Redis-backed cache layer.

Custom data source extensions can connect to identity providers, graph databases, internal APIs, or any system that holds authorization-relevant data.

Get started

Data source extensions are available as part of Cerbos Synapse. Talk to us to learn more about connecting your data stores to the authorization pipeline.

FAQ

What are data source extensions?

Data source extensions are reusable connectors to external data stores. Other Cerbos extensions — route, proxy, and Envoy — call data source extensions to retrieve context needed for authorization decisions. Results are cached with configurable TTLs.

What data stores are supported?

Cerbos includes built-in data sources for PostgreSQL, MySQL, and SQLite (with Litestream replication support). Custom data source extensions can connect to any system — identity providers, graph databases, internal APIs, or proprietary data stores.

Is caching built in?

Yes. Lookup results are cached with configurable TTLs using an in-memory or Redis-backed cache. This reduces latency and load on upstream systems while keeping authorization data fresh.