I have what might be a silly question. I have a bunch of things beyond AuthZ which would make sense to externalize to a policy engine. Things like policy-based data validation, where I’d be asking questions like, “Given this set of constraints, is this data element valid?“. It feels to me like the Cerbos PDP, while not specifically meant for this use case, has a policy engine that would serve the use case well. Has anyone ever tried anything like this?

It certainly sounds reasonable! What might the constraints and the data element look like? The PDP is just a decision engine at its core, so providing you can pass the context in the expected form, it should be able to make decisions for you.

Let’s say I have some datatype that, semantically, I call a Social Security Number. Under the hood, maybe it’s a String, whatever, but I treat it as its own Thing. I know that it follows exactly one of the following formats: XXX-XX-XXXX XXXXXXXXX Where each X must be a digit 0-9. The following would fail validation: • A12-34-5678 • 12-34-5678 • 1234567 • 123-456789 The following would pass validation: • 123-45-6789 • 123456789 Even better, I have a queryable / filterable entity (Pandas DF, Spark DF, whatever) that contains 0..* records which should align to the above format. I would like Cerbos to hand me back a query plan (another beautiful feature I love about you guys) which I can interpret to write a query which extracts only those records which are “valid”

Hmm, OK. Focusing on this particular example, I think it could be achieved with regex rules within a resource policy that looked vaguely like:

---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  resource: social_security_no
  version: default
  rules:
    - actions:
        - validate
      roles: ["*"]
      effect: EFFECT_ALLOW
      condition:
        match:
          expr: R.id.matches("^[0-9]{3}-[0-9]{2}-[0-9]{4}$")

The query plan aspect I'm less sure about as I'm not sure what it would currently output, but I can have a tinker next week! I'd expect it to require mapping to some database specific

match

query or the like.

Beautiful, I’ll probably experiment with this a little bit this week and report back!