Seamless policy development

Google Common Expression Language, CEL, enables Cerbos policies to offer powerful capability to define conditions that are evaluated against the data provided in the request. CEL is a robust language designed for simplicity, speed, and safety. With Cerbos' interactive REPL, you can experiment with writing CEL conditions, providing a seamless experience for policy development.

Key features

Operators and functions:

• Logical operators: Define conditions using common logical operations to check for values, compare attributes and more.
• Built-in functions: Utilize a wide range of built-in functions and operators in CEL such as working with lists, maps and timestamps.
• Cerbos-specific extensions: Use Cerbos-specific functions for handling hierarchies, IP addresses, and more.

Policy variables and auxiliary data:

• Avoid duplication: Define variables to avoid repetitive condition expressions.
• Auxiliary data: Access additional data sources, like JWT, in your policies.

Basic CEL condition example

        
      
      
condition:
 match:
    all:
      of:
        - expr: request.resource.attr.status == "PENDING_APPROVAL"
        - expr: >
            "GB" in request.resource.attr.geographies

Using the power of CEL, conditions can be as fine-grained as your business requirements, making use of all the request context to compute an authorization decision.