I just ran across this yesterday. It looks like, if I have attributes that need to be associated with the Principal that isn't part of our Identity system, then I have to maintain them in the application. Can the entries under “attr” be arrays of values?

Absolutely. Cerbos is stateless and also is decoupled from your authentication and directory systems. In every request, you can send the relevant attributes for the principal and the resource.

. The attributes object can be anything that can be defined in JSON - so yes you can have arrays of values.