Hey <!channel>! We’re hosting a 💻 📹 free webinar next week on layered security and Zero Trust. If one of your Zero Trust layers fails, what actually catches the threat next? Few teams can confidently answer what happens when a layer breaks - or whether the threat sails straight through to a breach. Aviation solved this decades ago with the Swiss Cheese Model, and we’re applying the same framework to runtime security. You’ll walk away with a practical way to stress-test your security layers, identify where the dangerous gaps are, and build a true Zero Trust Architecture you can stand behind. We’ll cover the six layers of runtime security (identity, authentication, PAM, entitlement management, coarse-grained and fine-grained authorization), where most orgs still have blind spots, and why end-to-end Zero Trust is finally implementable. 📅 Wednesday, March 18th · 6:30pm CET / 9:30am PST · 45 min + Q&A 🔗 Register here, if you’d like: https://zoom.us/webinar/register/9117730533248/WN_rBAJChIBR52EEd5XeNI9xw PS. No worries if you can’t make it live. Register anyway and we’ll send the recording post-webinar.

Cerbos turns 5 today. 🎉 For five years, Cerbos has been helping teams run secure, scalable authorization. Cerbos is now used by companies around the world to manage complex permissions, enforce policies consistently, and control what AI agents are allowed to access and do. Grateful to everyone building with Cerbos and helping us grow.

Hey everyone 👋 We have some more cool news to share: we're introducing Cerbos for agentic commerce. AI agents are starting to place orders, trigger refunds, and modify subscriptions inside e-commerce systems. The question becomes: what are those agents actually allowed to do? Cerbos helps e-commerce platforms evaluate every AI agent purchase, refund, and subscription action against centralized authorization policies before money moves: • Evaluate agent actions against policies at runtime • Enforce authorization at the API boundary where agent transactions execute • Apply consistent policies across storefronts, APIs, and integrations • Maintain a clear decision trail showing which policy allowed or denied each action If you are building agent-driven commerce systems, see how authorization policies can control agent transactions. 👉 https://www.cerbos.dev/agentic-commerce

Happy Friday everyone 🙂 Big one today, we’re introducing Cerbos Synapse 🎉 Every authorization decision is only as good as the data behind it. Who is this user? What groups are they in? What resource are they trying to access? Most teams end up building this data plumbing themselves, repeatedly, across apps, services, and increasingly AI agents in their stack. Cerbos Synapse enriches authorization requests with identity, resource, and relationship data from your existing systems before the policy engine evaluates what to allow: ✔️ No custom enrichment middleware ✔️ Native integrations for Envoy, Kafka, Trino, and Kubernetes ✔️ Built for AI agents and non-human identities ✔️ Complete audit trail from data source to decision outcome Extensions can be written in Go or any language that compiles to WebAssembly, so you're not locked into one ecosystem. Happy to answer any questions here, or feel free to explore Cerbos Synapse yourself: https://www.cerbos.dev/product-synapse

👋 Hey everyone, We’ve been seeing Claude Code spread well beyond engineering. Marketing teams exploring codebases, product managers reading configs, data analysts grepping logs. But there is a gap. There is no central, enforceable way to control what those agents can actually do. Hooks exist, but they are local config, per developer, opt-in. That means no consistent enforcement across the org and no reliable way to see what agents actually did. 🎉 Today, we are introducing centralized authorization for Claude Code agents. Every tool call is intercepted and checked against policy before it runs. That gives you control over what agents are allowed to do, at the moment they act: • Allow or deny decisions on every tool call, not just monitoring • Role-based controls so engineers can use Bash while other teams stay read-only • Full audit log tied to the user behind each agent action • Policies as code, versioned, reviewed, and updated without redeploying anything Policies and audit logs are managed in Cerbos Hub, so you have one place to control access and understand what agents are doing across your org. If you want to see how it works or try it out, we’re around and happy to help: 👉 https://www.cerbos.dev/ecosystem/claude-code 👉 https://www.cerbos.dev/workshop

Hey community! Hope your week is going well 😊 We wanted to share our new guide + demo with you. It’s all about using Cerbos Synapse with Apache Trino. It covers how to add row-level security, column masking, and table-level access control to Trino through its existing OPA plugin. Synapse handles the protocol translation and enriches each query with user attributes from your IdP, so your Cerbos policies control what each user sees down to the row and column level. The 3-min demo shows three users running the same SELECT query and getting completely different results based on who they are. Blog + If you’re running Trino and have questions about the setup, drop them here :)

Hey everyone, happy Friday ☺️ We just published a new blog on the 5 authorization blind spots auditors find most often in enterprise access control. It walks through the things that come up again and again in real audits - scattered authorization logic across codebases, policies that exist on paper but no proof of enforcement, quarterly access reviews that check role labels instead of actual permissions, non-human identities running with standing privileges, and AI agents deployed without an authorization model. Each section has a “what to do now” piece with practical steps to close the gap before the next audit cycle. Hoping it’s useful for anyone working through SOC 2, ISO 27001, HIPAA, or similar frameworks, or just generally rethinking how authorization fits into their Zero Trust setup 🙂 Full blog: https://www.cerbos.dev/blog/5-authorization-blind-spots-auditors-find-and-how-to-fix-them Have a great weekend!

Hey everyone! Excited to share a walkthrough on using Cerbos Synapse to add authorization to legacy applications without any code changes 🙂 Envoy sits in front of the app as a reverse proxy, handles authentication against your IdP, and calls Synapse for a policy decision on every request. The legacy app doesn’t need an SDK, doesn’t need modifications, doesn’t even know Cerbos is there. 📖 Full guide with policy examples and a phased rollout path 🎥 showing it in action with a legacy payroll app If you’re dealing with legacy systems that have been sitting outside your authorization framework, this one’s for you!

Hey community 👋 We just published a new guide on writing Cerbos authorization policies with an agent skill we’ve released. The hardest part of writing authorization policies isn’t the policy language. It’s the translation from business requirements into a precise spec of who can do what, under which conditions, on which resources. So we built an agent skill that handles the translation for you. You describe the access rules in plain English (or any language!), it asks the clarifying questions to tighten up anything vague, then generates the full policy bundle for you, including schemas, derived roles, resource policies, and tests, and validates every output against the real Cerbos compiler. If validation fails, it reads the errors and keeps fixing until the policies compile cleanly. It works in Claude Code, Cursor, Codex, OpenCode, and 10+ other agents. Install is one command: Full write-up here: https://www.cerbos.dev/blog/agent-skill-for-writing-authorization-policies

Release - v0.52.0 New release published by github-actions[bot] Cerbos 0.52.0 View the full release notes at https://docs.cerbos.dev/cerbos/latest/releases/v0.52.0.html Changelog • 2812325 Add 0.52.0 release notes (#3127) • 3f8cfc3 Add TraceBatch format for compact trace representation (#2945) • 9a8ceb5 Add ability to save Hub credentials (#3067) • 78fec1d Add build constraints (#2979) • 6e74c62 Add changelog entry for breaking OpenTelemetry changes (#2954) • d7eefbe Add pages/recipes for common questions (#3106) • 9fb62a2 Add path functions to Cerbos CEL library (#3039) • f3f464b Add permissions advisor workflow (#3007) • ad8d242 Add siteline to docs (#3093) • b9dc7e1 Add tracer.TracesToBatch (#2958) • de243ba Add verify.BundleStream (#2944) • f8a1020 Additional repository statistics (#3025) • 681bcf8 Avoid compiling constant expressions at runtime (#3005) • cbfb1b3 Avoid round-tripping attributes to JSON for schema validation (#3000) • f0e0df7 Bump brace-expansion from 2.0.2 to 2.0.3 in /npm/test/registry (#3062) • 74fa896 Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#2975) • a3f8d30 Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.96.4 to 1.97.3 in /tools (#3083) • a02dfd0 Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.97.1 to 1.97.3 (#3082) • dce4632 Bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 in /tools (#3054) • 489656f Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#2980) • bf6e74a Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 in /hack/tools/changelog (#2981) • 96b53c0 Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 in /tools (#2987) • 04960ce Bump github.com/docker/cli from 27.4.1+incompatible to 29.2.0+incompatible (#3004) • a78b47a Bump github.com/go-git/go-git/v5 from 5.17.0 to 5.17.1 in /hack/tools/changelog (#3070) • 8d29a2f Bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 in /tools (#3109) • 10d8886 Bump github.com/go-git/go-git/v6 from 6.0.0-alpha.1 to 6.0.0-alpha.2 in /hack/tools/changelog (#3113) • f1706dd Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#3072) • 9d61b19 Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in /hack/loadtest (#3073) • e9bbc5e Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in /tools (#3074) • 35fd059 Bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (#3118) • d4cd21c Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 in /tools (#3104) • 6febdf3 Bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /api/genpb (#3121) • ebe00a5 Bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /hack/loadtest (#3126) • 6071f59 Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 in /tools (#2986) • 73c754d Bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in /tools (#3097) • <ht… cerbos/cerbos

Release - v0.53.0 New release published by github-actions[bot] Cerbos 0.53.0 View the full release notes at https://docs.cerbos.dev/cerbos/latest/releases/v0.53.0.html Changelog • 93a75a6 Add Helm release workflow and bump chart version to 0.52.1 (#3133) • 218ea22 Add v0.53.0 release notes (#3143) • 81ab26e Fix rendering of wildcard characters (#3140) • 77974a7 Migrate to

cerbos/actions

(#3120) • 2e8e054 Move Helm release to its own workflow (#3135) • 7cd3152 Move path functions documentation to correct place (#3139) • d72ef61 Remove JWT verification cache (#3138) • 5028a6f Remove

voxmedia/github-action-slack-notify-build

(#3129) • ccc98e9 Remove incorrect default tag value from Helm chart (#3131) • ea252b9 Set

Content-Type

to

application/x-ndjson

on streaming responses (#3130) • cc293e2 Update GitHub Actions deps (#3124) • 2261983 Update cerbos/actions to bb55708 (#3142) • 51ab843 Update to

<http://github.com/ory/dockertest/v4|github.com/ory/dockertest/v4>

(#3136) • 78d494c chore(release): Prepare release 0.53.0 • 47b23a4 chore(version): Bump version to 0.53.0 • c1d70c9 fix planner ignoring OVERRIDE_PARENT for parent DENYs (#3137) cerbos/cerbos

Hey everyone! 👋 hope your week is off to a good start! We just published a page on AI gateway authorization, walking through how to layer fine-grained access control on top of your AI gateway. Feel free to check it out if it’s relevant for you ☺️ AI gateways are good at telling you who’s calling but not what that caller is actually allowed to do. Once an agent starts using tools, calling an LLM, or delegating to another agent, the human behind the request tends to disappear from the audit trail, sub-agents end up inheriting more privilege than they should, and revoking access usually means rotating credentials or redeploying. The page covers what changes when every model call, tool invocation, and agent-to-agent handoff runs through the same policy layer your apps already use. You end up with one audit trail across humans, services, and agents, sub-agents that stay scoped to what the parent had, and policy changes that take effect at request time rather than at deploy time. Plus evidence trails that line up with SOC 2, ISO 27001, HIPAA, and DORA.

Hey community 😊 Update for those working in automotive 🚗 UNECE R155 and R156 are now type approval requirements for new vehicle types in UN 1958 markets. They require auditable evidence of who can push what firmware, to which vehicles, under which conditions. Most platforms have that logic scattered across services in different languages, which is exactly what an auditor can’t follow. We just published a guide on the authorization layer that actually produces that evidence. It walks through the

YAML

for a single OTA deploy action across five principals (vehicle engineer, production manager, owner, OEM partner, telematics agent), plus supplier data scoping and ECU diagnostics. Full write-up, with the allow/deny matrix and YAML per principal

Hey everyone 👋 Hope your week is off to a good start! If you’re running our open-source Cerbos PDP, your authorization decisions are happening thousands / millions of times a day with no easy way to see the shape of that traffic. We just shipped 🚀 Insights to change that, a new page in every Cerbos Hub workspace that aggregates the decisions flowing through your PDPs into charts and rankings, so the patterns are obvious without you going looking for them. You get allows and denies over time (hourly for the last 7 days, daily for the last 30), a count of active principals, and rankings of your busiest principals, resource kinds, and resource and action pairs. A spike in denials usually means a policy landed stricter than intended or a client is calling for something that no longer exists, and seeing it on a chart is the difference between catching it in minutes and hearing about it from a user days later. Every chart links straight back into the audit log, pre-filtered to match what you’re looking at, so you can drop into the underlying decisions without rebuilding the filter by hand. The best part is there’s nothing new to wire up. It’s built entirely on the decision data your PDPs already send to Hub, so once audit log collection is on, the page populates on its own. If your PDPs aren’t connected to Hub yet, this is the kind of thing you get when they are. Details can be found here

Hey <!channel>! We have a 📘 🔐 new ebook out: The Authorization Maturity Model, a CISO's Benchmark for 2026 If you’ve read our How to adopt externalized authorization ebook, this is the security team equivalent. It gives CISOs: • A 4-stage model to benchmark where their authorization program actually stands • A regulator-by-regulator exposure rating across NIS2, DORA, SEC, the EU AI Act and more • And a 90-day plan to close the gaps. Written by Alex Olivier, our CPO and co-chair of OpenID AuthZEN. And if you’ve been trying to get security leadership behind a real authorization push, this is a good way in. It puts the work in the terms a CISO answers to, regulatory exposure and board-level risk, which is usually what unblocks the buy-in and budget to get started.

Hey community, some more news for you all - we just shipped an 🤖🚀* agent skill for building Cerbos Synapse extensions* Cerbos Synapse lets you shape what flows through your Policy Decision Point. Enrich a principal with attributes from a database before the decision runs, map an incoming HTTP or Envoy request onto a check, or stand up a custom endpoint under /ext/ that does exactly what your app needs. The skill builds those extensions for you. You describe what you want in plain terms, something like “enrich the principal with the user’s department from Postgres before the check runs,” and it picks the extension kind and runtime, scaffolds the files, wires the config, writes a test suite, and runs it against a local PDP. You get a working extension to drop into your own project, not a blank file. Feel free to check it out here.

Hey everyone 👋 hope your week’s off to a good start We just shipped the Effect matrix in Cerbos Hub. It takes the same compiled policy you already deploy and lays it out as a grid, roles down one side, actions across the top, every cell showing allowed, denied, or conditional. If you’ve ever had a product owner, a reviewer, or support ask “can this role actually do that,” you know the answer normally means reading through resource policies, derived roles, and conditions to be sure 👀_. The matrix answers it at a glance, without anyone needing to read raw policy._ You’ll find it on the Policies tab of a deployment, as a toggle between Source and Effect matrix. Conditional cells aren’t flattened into a yes or no. They’re marked conditional, and you can click in to see the exact rule and the condition behind it. It also flags the cells a wildcard rule reaches into, so a broad

documents:*

grant shows up as broad instead of hiding in a pattern. It’s live now for any deployment in Cerbos Hub cerbie🚀 Full write-up here

Hey everyone 👋 hope your week is off to a good start We just published a guide on running an authorization POC that actually reaches production ⚙️*.* Most POCs don’t fail on the technology. They stall when success criteria only get defined at the end, so three weeks in the demo works but it’s hard to say whether that proves anything. The guide covers how to scope the POC to one real service instead of a demo app, the six questions worth answering before day one (can it model your real rules, does latency hold under real load, does the audit output satisfy compliance, and so on), who needs to be in the room while it runs, and why two to four weeks with a hard deadline beats an open-ended pilot. Full write-up here: cerbos.dev/blog/authorization-poc-guide

Hey everyone! For anyone at 🌍 WeAreDevelopers World Congress in Berlin this week: Alex Olivier, our co-founder and CPO, and co-chair of the OpenID AuthZEN working group, is speaking tomorrow on securing AI agents once they stop reading and start acting. Prompt instructions aren’t a security boundary, and the talk covers what to put there instead. “The day the chatbot asked for sudo” Thursday, July 9, 11:30 to 12:00, Stage 6 If you’re around and want to chat in person, DM Alex on LinkedIn and he’ll make sure you find each other: linkedin.com/in/alexolivier

Release - v0.54.0 New release published by github-actions[bot] Cerbos 0.54.0 View the full release notes at https://docs.cerbos.dev/cerbos/latest/releases/v0.54.0.html Changelog • 64d274b Auto-configure GOMEMLIMIT from the cgroup memory limit (#3259) • 3870a7d Add CI performance regression test (#3174) • 6b483c6 Add

cerbos.audit.v1.PolicySource.Hub.EmbeddedBundle.bundle_id

field (#3155) • 0bacbd6 Add cerbos compile-store command (#3251) • b6fb643 Add dimension filters to ruletable index key queries (#3235) • f77ba9c Add new documentation homepage and cross linking (#3264) • ffc7e76 Add proxy support for Hub client (#3221) • 9e8e948 Add role policy outputs, constants and variables (#3156) • 44dd5de Add v0.54.0 release notes (#3282) • 3fb9576 Allow disabling TLS verification for Hub client (#3220) • a39c824 Build binaries at AMD64 microarchitecture level v2 (#3218) • db8f3fb Bump fast-uri from 3.1.0 to 3.1.2 in /npm/test/registry (#3162) • 9d46168 Bump github.com/go-git/go-billy/v6 from 6.0.0-20260424211911-732291493fb8 to 6.0.0-alpha.1 (#3178) • 305bfbf Bump github.com/go-git/go-billy/v6 from 6.0.0-20260424211911-732291493fb8 to 6.0.0-alpha.1 in /hack/tools/changelog (#3177) • fc7f84f Bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /hack/loadtest (#3272) • 322a56c Bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /hack/tools/changelog (#3271) • 3ae505b De-duplicate and re-allocate rule table objects (#3209) • bdaf976 Disable telemetry in CI performance regression test (#3277) • 69be648 Display output errors in passing tests and JUnit report (#3202) • 54046f0 Downgrade to go1.25 (#3237) • 588fc4b Enable incremental rule table marshalling (#3270) • 1891961 Export binary path from npm packages (#3180) • 96880d9 Expose parser (#3276) • 35f56ca Extend the load-test framework to measure PDP memory demand and GC behaviour under load (#3258) • 2acd6f2 Fix E2E SDK test (#3239) • 2a7007c Fix Siteline edge function (#3186) • 79d90eb Fix npm package templates (#3181) • f09accf Fix panic in E2E blob test (#3242) • 1bda684 Fix parser bugs (#3223) • 3352262 Fix typo in performance regression check workflow (#3179) • f2c6387 Handle permission denied error from Hub API (#3248) • 9ea7f61 Ignore

helm/*

tags when building snapshots (#3152) • 218362c Import GPG key for Helm Secrets before installation (#3219) • 5ac3bd8 Iterable stores (#3253) • ae6972a Lazy load sparse bitmaps (#3200) • 16888ec Lock file maintenance (npm) (#3168) • 6b49993 Lock file maintenance (npm) (#3195) • 72a094b Lock file maintenance (npm) (#3226) • bed9c7d Log CEL runtime errors and record them in audit entries (#3260) • cd8a94c More compact fqnBindings dimension (#3154) • <https://github.com/cerbos/cerbos/commit/8465b2ece823a4e079… cerbos/cerbos

Hey everyone 👋 hope your week is off to a good start! A while back we released an agent skill that writes Cerbos authorization policies for you. You describe the access rules in plain English, it asks the clarifying questions to tighten up anything vague, then generates the full policy bundle, including schemas, derived roles, resource policies, and tests. It validates every output against the real Cerbos compiler, and if validation fails it reads the errors and keeps fixing until the policies compile cleanly. We’ve now got step-by-step guides for each tool (Claude Desktop, Claude Code, Cursor, VSCode, Codex, OpenCode, Pi, Kiro), so whichever agent you’re in, there’s a walkthrough for getting set up :)

Hey everyone, hope your week is going well! We’re happy to share that we have launched a 🤝 referral program 🤝 If you introduce us to a team that becomes a paying Cerbos customer, you get $1,000. You pick how it’s paid, as account credit against your company’s next invoice, a donation to a charity of your choice in your name, or cash to you where eligible. Plenty of teams are still building authorization in-house. The logic ends up spread across every service, engineering months go into something that isn’t the product, and every permission change waits on a release. Those are the teams we’d like to reach, and most of you will spot them long before we do. Submitting takes a couple of minutes. Send a name, email, company, and title, and our team handles the rest. You hear from us when the deal closes and it is time to sort the payout. Details and full terms can be found here: cerbos.dev/referral-programme Have an awesome rest of your day 😊

Release - v0.55.0 New release published by github-actions[bot] Cerbos 0.55.0 View the full release notes at https://docs.cerbos.dev/cerbos/latest/releases/v0.55.0.html Changelog • 2f4bb25 Add missing build tags (#3323) • d7e5883 Add v0.55.0 release notes (#3325) • f8e167b Bump body-parser from 1.20.5 to 1.20.6 in /npm/test/registry (#3293) • 0fdc6f5 Bump brace-expansion from 5.0.8 to 5.0.9 in /npm/test/registry (#3313) • e5c7ffd Bump fast-uri from 3.1.2 to 3.1.4 in /npm/test/registry (#3290) • 5826462 Bump fast-uri from 3.1.4 to 3.1.5 in /npm/test/registry (#3314) • c925516 Bump google.golang.org/grpc from 1.81.0 to 1.82.1 in /hack/loadtest (#3286) • 82bbb66 Bump google.golang.org/grpc from 1.82.0 to 1.82.1 in /api/genpb (#3288) • ee46565 Bump google.golang.org/grpc from 1.82.0 to 1.82.1 in /tools (#3289) • 0e5ff37 Bump js-yaml and verdaccio in /npm/test/registry (#3294) • 459cd46 Enable constant folding in CEL expressions (#3316) • c1d466d Fix inconsistent behaviour of CEL functions 'except', 'hasIntersection', 'intersect' and 'isSubset' (#3306) • 85b6551 Handle YAML block scalar syntax in test fixture attributes (#3305) • a1f8f8a Plan API log clear error when optional type is retained in residual expression (#3324) • 8301e92 Refactor engine tests (#3317) • 2b47665 Remove stargazers section from README (#3321) • 17a7c12 Replace gsutil with gcloud storage (#3284) • 3b26a1e Set log level to error for CI performance regression test (#3304) • 69bed7f Strict evaluation mode (#3312) • 91dd560 Support multiple JWTs (#3283) • 317b9b6 Update GitHub Actions deps (#3292) • a9b1034 Update GitHub Actions deps (#3309) • 2b49097 Update GitHub Actions deps to v7 (#3301) • 65d0c38 Update Go deps (#3298) • 285c529 Update Go deps (#3311) • 48c32d0 Update Go deps (#3319) • 10ebc7c Update Helm release seaweedfs to v4.40.0 (#3299) • d166fdd Update Node.js deps (#3297) • 4d6cf52 Update actions/cache action to v6 (#3300) • 4d40ced Update cerbos/actions to 120749e (#3318) • 03a0e72 Update cerbos/actions to 7df6503 (#3291) • 22e2197 Update cerbos/actions to cb30b08 (#3310) • c088d49 Update dependency node to v24.18.1 (#3308) • ad7fecc Update module github.com/cenkalti/backoff/v5 to v7 (#3302) • 7368d7f Update module google.golang.org/grpc to v1.82.1 [SECURITY] (#3287) • c861c26 Update npm to v12 (#3303) • 4962984 Update to Go 1.26 (#3322) • fa056fa Upgrade to CEL 0.30.0 and enable new extensions (#3296) • 2901f64 chore(release): Prepare release 0.55.0 • d9019a5 chore(version): Bump version to 0.55.0 cerbos/cerbos

Hey everyone! 👋 Hope your week is off to a good start We just published a guide for anyone deciding between running the open source Cerbos engine on its own, or using to the full Cerbos authorization management platform. The short version is that the open source engine is complete and stays that way, so for a single service it’s often all you need. But once you have more than one service, more than one environment, or anyone asking for an audit trail, the platform is what keeps authorization maintainable as it grows. The guide walks through what the paid side actually gives you: policy pushed to every instance in seconds, your tests run in CI, searchable audit logs you can trace back to the exact policy, the identity and resource data each decision needs pulled in for you, and more. Full write-up here: cerbos.dev/blog/open-source-vs-paid-cerbos ❓cerbie

Hi, community 😊 Emre Baran and Alex Olivier will be at 🌎 Identity Week America this week, 2 and 3 September at the Walter E. Washington Convention Center in DC. Booth 720. If you’re going, come and say hello. Our team is happy to dig into whatever you’re working on, whether that’s a role model that stopped scaling, policy design questions, or how you’re handling authorization for AI agents. Alex also co-chairs the OpenID AuthZEN working group, so if you have opinions on the spec now that it’s ratified, he will want to hear them. Wishing everyone a great, productive week! P.S. If you’re not at the conference but there’s something you would have asked at the booth, feel free drop it in here and we’ll answer. Or simply DM Emre / Alex.

Hey everyone! 👋 Cerbos Hub has a new look as of today. Along with a visual refresh, there are a few small changes to how you get around, so you’ll notice it the next time you sign in. • Hub now follows your system theme, dark or light, or you can set it manually. • The organization and workspace switcher sits in a navigation bar at the top of every page, so you can move between them without leaving the page you’re on. • Common views like policy lists and audit logs show more rows per screen with less scrolling, which helps most when you’re working through decision logs. • The markup across the app has been updated to current accessibility standards helping humans and agents. Everything works the way it did, and there’s nothing you need to do on your side. More on each of these, with screenshots, in our blog. If you have any feedback on the new interface, or a view you’d like to see next - please let us know in this thread! 😊

For those running Cerbos in an environment with Prometheus and Grafana we have published a dashboard on the Grafana Labs dashboard repository. It is also available in the Cerbos source tree at

./hack/loadtest/conf/grafana/*dash*boards/cerbos.json

grafana.com/grafana/dashboards/25769-cerbos

Hey, community! For anyone heading to WeAreDevelopers World Congress in San José this week 👇 Alex will be there and is speaking on Thursday, September 24 at 4:50 PM on Stage 2. 🔊*His talk* is about what happens when authorization logic is spread across services, gateways, workers, data platforms and AI systems, and each one decides on its own. He goes through real incidents, the warning signs that show up before them, and a checklist for keeping authorization predictable and testable as decision volume grows. If you are at the congress, feel free to stop by and listen 😊 And if you would rather talk through your own setup, you can message Alex on LinkedIn to set up a time to meet in person. He is around for the rest of the day and would be glad to see anyone from the community.

Release - v0.56.0 New release published by github-actions[bot] Cerbos 0.56.0 View the full release notes at https://docs.cerbos.dev/cerbos/latest/releases/v0.56.0.html Changelog • 3ad9fa7 Add v0.56.0 release notes (#3399) • 8bc6285 Better error message when disk directory doesn't exist (#3368) • 8bd3cef Bump fast-uri from 3.1.5 to 3.1.7 in /npm/test/registry (#3353) • 460f294 Bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /hack/loadtest (#3351) • f3180bb Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /tools (#3352) • 6734b2d Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /hack/loadtest (#3369) • 2101aee Docs CTAs UTM per placement and fix header nav links (#3327) • a1505ac Fix a drain profile test (#3401) • 8434848 Fix principal policy precedence in query planner (#3391) • b71fb4f Fix role policy evaluation for resource kinds containing special characters (#3390) • d4c205a Fix zizmor issues (#3370) • db84c97 Handle empty fixture files (#3380) • 126ca98 Ingest raw audit log bytes to Hub without re-marshalling (#3376) • 18599b9 Match principal policy globs against raw and sanitized resource kinds (#3395) • 6d62b59 Redirect the removed Hub Synapse page to the Synapse docs (#3326) • cead457 Reduce the peak memory of hub audit log catch-up (#3363) • 4f91a6f Reject policies with conflicting scopePermissions (#3389) • cd3efaf Remove

url.verified

from GoReleaser Homebrew cask config (#3386) • f9fcaa9 Remove deprecated config (#3392) • e2b3e7f Return correct error code for context errors (#3385) • 000a0d5 Support specifying a target for Hub audit log ingest (#3400) • 02b6c2a Tune BadgerDB settings (#3378) • 9d83c3c Update CONTRIBUTING.md regarding profile-padding attempts (#3362) • 89fb858 Update GitHub Actions deps (#3330) • c13d1e0 Update GitHub Actions deps (#3360) • 75e7a26 Update GitHub Actions deps (#3383) • 04bbc1e Update Go deps (#3329) • baabfca Update Go deps (#3339) • 0730ed1 Update Go deps (#3349) • 7a4a6bc Update Go deps (#3365) • 5d64431 Update Go deps (#3372) • 466ce7f Update Go deps (#3384) • 11afd2a Update Go deps (#3396) • 32f0ff1 Update Go deps to v1 (#3398) • 7d223b5 Update Grafana dashboard (#3354) • 223c514 Update Helm release seaweedfs to v4.41.0 (#3331) • d780713 Update Helm release seaweedfs to v4.42.0 (#3343) • 3561142 Update Helm release seaweedfs to v4.45.0 (#3366) • 70a2286 Update Helm release seaweedfs to v4.46.0 (#3373) • 53bbe7d Update Helm release seaweedfs to v4.47.0 (#3397) • e340081 Update Node.js deps (#3332) • e340c61 Update Node.js deps (<https://github.com/cerbos/cerbos/p… cerbos/cerbos

Hi, community 😊 Hope the week’s going well! We just published a guide on who owns authorization in a large engineering organization, and part of the answer is a file you probably already have,

CODEOWNERS

. When authorization rules are scattered through application code, ownership turns into an org chart argument. The identity team’s job ends once the user is logged in, every product team writes its own permission checks, and security has no single place to review any of it. Once the rules live as policies in one repository, the question has a literal answer.

CODEOWNERS

says which team owns which policy, the pull request history shows who approved each change, and CI shows the policy was tested before it shipped. The guide builds the rest of the ownership model around that. A platform team runs the service that makes each allow or deny decision and keeps the audit logs, product teams own the policies for what they build, security owns the standard and the review, and the identity team keeps the user attributes those decisions rely on accurate. It also covers how to try this on one workflow first, like a support tool that needs write access to production, so the first team sees a permission change go out as a policy commit rather than a code deploy. Full write-up here: cerbos.dev/blog/who-owns-authorization-in-large-engineering-organization