Every decision, every action recorded

Collect and collate records of every action, decision, and change across all your Policy Decision Point instances.

Easily manage and review all your logs

Audit Logs enable enhanced security, easier compliance verification and faster debugging.

Each Cerbos PDP instance records detailed audit logs for every decision made. When collected by Cerbos Hub, all the logs are centralized, making it easy to manage and analyze them from a single pane. Speed up your workflow with two types of logs:

Decision logs track authorization checks, showing who tried to do what and whether they were allowed or denied. Decision logs include details about decision lineage, which are vital for compliance checks and security investigations.
Access logs keep chronological records of API requests and their sources. They help debug PDPs, and ensure you meet security standards in your application.

See Audit Logs in action with Cerbos PDP

This sample log entry indicates that user "sally" was allowed to view "expense1" based on the expense resource policy (default version). It’s really that simple.



        
      
      
{
  "timestamp": "2023-01-05T15:51:13.150492178Z",
  "requestId": "01GP1A25FW6BVX9JWYM9M6T0Z0",
  "principal": {
    "id": "sally",
    "roles": ["USER"],
    "attr": {
      "region": "EMEA",
      "department": "SALES"
    }
  },
  "resource": {
    "kind": "expense",
    "id": "expense1",
    "attr": {
      "status": "PENDING",
      "amount": "40",
      "region": "EMEA",
      "vendor": "Expense 1",
      "approvedBy": "frank",
      "createdAt": "2023-01-03T15:45:55.461Z",
      "ownerId": "sally"
    }
  },
  "action": "view",
  "effect": "EFFECT_ALLOW",
  "policy": "resource.expense.vdefault",
  "effectiveDerivedRoles": ["OWNER"]
}

Copy

Audit logs in Cerbos Hub

Cerbos Hub brings all Logs together in one unified view, making it easier to troubleshoot and giving teams more control over managing authorization. So you retain control over all your permissions.