Cerbos Community #help
Channels
# help
t
Tojo RODIALSON
01/26/2024, 3:55 PM
I have question if cerbos have UI?
- 2
- 8
r
Rafael Szuminski
02/06/2024, 6:17 PM
Hi All, I'm experiencing a fairly slow startup of cerbos docker containers. It takes about 60 seconds to transition from (health: starting) to {healthy). Is this normal?
- 3
- 31
b
Brandon Choe
02/13/2024, 4:58 PM
hi 👋. when using the Prisma integration, how are conditions based on the principal evaluated? are they done in Cerbos, then the resource-based conditions are returned as part of the query plan?
- 2
- 8
d
Dimitar Danailov
02/16/2024, 5:09 AM
👋 Hello, team!
d
Dimitar Danailov
02/16/2024, 5:13 AM
I’d like to ask you about a rule
I’ve been working on a booking software. Each booking has different states. I’ve an action and different results
Copy code
const hasAccess: boolean = await cerbos.isAllowed(request);
// if the booking.status is CONFIRMED -> true
// if the booking.status is AMENDED -> false
The policy rule is:
Copy code
- actions: ["UPDATE"]
effect: EFFECT_ALLOW
derivedRoles:
- BOOKING_Role1
- BOOKING_Role2
condition:
match:
any:
of:
- expr: request.resource.attr.status == "INITIALIZED"
- expr: request.resource.attr.status == "BOOKED"
- expr: request.resource.attr.status == "PENDING"
- expr: request.resource.attr.status == "CONFIRMED"
- expr: request.resource.attr.status == "AMENDED"
- 2
- 7
p
Peter Garner
02/16/2024, 11:55 AM
Hi Cerbos team and friends. Hot off the Jamstack podcast here, was checking out the tool, and had a question about a use case to see if Cerbos could potentially work.
p
Peter Garner
02/16/2024, 11:57 AM
I see that the data model for ABAC supports roles and attributes on the principal.
p
Peter Garner
02/16/2024, 11:57 AM
What I'm trying to model is a scenario like this:
p
Peter Garner
02/16/2024, 11:58 AM
Resource kind = Campaign
p
Peter Garner
02/16/2024, 11:58 AM
A campaign will have attributes of Publisher and Country.
p
Peter Garner
02/16/2024, 11:58 AM
and lets say actions are "view" and "edit".
p
Peter Garner
02/16/2024, 11:59 AM
I want to be able to assign a Principal to be able to "edit" only campaigns that are in Country=CA, but I want them to be able to "view" campaigns that are in both Country = CA and Country = US.
p
Peter Garner
02/16/2024, 12:01 PM
the system that maintains the authorization rules will have the data about the principal (i.e. if they can edit CA, and view CA and US).
p
Peter Garner
02/16/2024, 12:01 PM
but its not really managed as "roles" in that system, the assignment happens at the granularity of the resource and is quite flexible to create all of those combinations.
p
Peter Garner
02/16/2024, 12:01 PM
Any thoughts on how best to model something like that?
- 2
- 12
m
Madhu Jahagirdar
02/18/2024, 2:18 AM
we would like to know whether cerbros integerates with Azure AD or google cloud identify IDP
- 2
- 2
r
Roman Levytskyi
02/19/2024, 8:49 AM
Hi guys, We want to use the audit logs which Cerbos produces, but the JS SDK does not contain either method or models. Why is that, is it going to be available anytime soon or should we write our own wrapper/definitions?
- 4
- 15
s
Sai Kumar Gade
02/22/2024, 3:47 AM
Hi people, I get this error while I’m using cerbos embedded in nodejs
Copy code
Uncaught SyntaxError /node_modules/@cerbos/embedded/lib/client.js:40
this.server = server(instantiate(source, options), options.decodeJWTPayload ?? cannotDecodeJWTPayload, options.globals);
SyntaxError: Unexpected token '?'
- 4
- 14
a
Alex Dolid
03/04/2024, 2:27 PM
hello everyone 🙂 does cerbos works with fly.io ? I tried to configure fly.toml but I see an error in the logs in my nodejs server
Copy code
{"type":"Error","message":"gRPC error 14 (UNAVAILABLE): read ECONNRESET","stack":"NotOK: gRPC error 14 (UNAVAILABLE): read ECONNRESET
my fly.toml configuration
Copy code
app = 'cerbos-service'
primary_region = 'waw'
[build]
[http_service]
internal_port = 3592
force_https = true
auto_stop_machines = true
auto_start_machines = true
min_machines_running = 0
[http_service.http_options]
h2_backend = true
[[services]]
internal_port = 3592
protocol = "tcp"
auto_stop_machines = true
auto_start_machines = true
min_machines_running = 0
[[services.ports]]
handlers = ["http"]
start_port = 3592
end_port = 3592
[[services]]
internal_port = 3593
protocol = "tcp"
auto_stop_machines = true
auto_start_machines = true
min_machines_running = 0
[[services.ports]]
handlers = ["tls", "http"]
start_port = 3593
end_port = 3593
[services.ports.tls_options]
alpn = ["h2"]
[[vm]]
size = "shared-cpu-1x"
memory = '256mb'
cpu_kind = 'shared'
cpus = 1
- 3
- 24
m
Martin Schmengler
03/07/2024, 8:39 AM
Hello Cerbos-Team, We just found an issue with the Cerbos SDK - see the following Github issue: https://github.com/cerbos/cerbos-sdk-python/issues/49
We would appreciate a fix for this in the next version of the Cerbos SDK.
👀 1
- 3
- 3
a
Avinash Dalvi
03/16/2024, 2:39 AM
Trying to run this
docker run --rm --name cerbos -d -v $(pwd)/cerbos-quickstart:/quickstart -p 3592:3592 <http://ghcr.io/cerbos/cerbos:0.34.0|ghcr.io/cerbos/cerbos:0.34.0> server --config=/quickstart/.cerbos.yaml
with custom but it just getting random ID as output but docker is not running. I want to run configuration inside this project https://github.com/cerbos/nextjs-prisma-cerbos any help ? as per this document https://docs.cerbos.dev/cerbos/latest/installation/container
✅ 1
- 2
- 2
a
Avinash Dalvi
03/16/2024, 3:35 AM
Store does not support regexp filters
anyone came across this error in API. I tried to find out documentation around couldn’t find any. Due to this not able to see list of policy and not able to check policy id to fetch policy details
- 2
- 1
l
Lindsay Cade
03/19/2024, 3:24 PM
Hello! I am running into an issue with the sqlalchemy
get_query
method. I have posted an issue here: https://github.com/cerbos/query-plan-adapters/issues/69 I would love any help or advice! Thanks!
- 3
- 24
f
Fatuma A
03/22/2024, 4:48 AM
Hi, I noticed a few issues while using Cerbos Hub I wanted to report here: 1. I got this unexpected 0 error while moving files around in the playground, attached image 2. There is white navigation links and button text on bright yellow background. Very hard to read. 3. While in the playground, I could not find a way to delete the organizations I made.
- 2
- 4
f
Fatuma A
03/22/2024, 4:50 AM
I also noticed the community page has a search bar that is barely visible as illustrated in the picture.
b
Brandon Choe
03/22/2024, 7:02 PM
hi 👋. how do one-to-many relationships work with the Prisma adapter? I'm getting
Unsupported operator exists
when I try to pass in a relation to
fieldNameMapper
Copy code
queryPlanToPrisma({
queryPlan,
fieldNameMapper: {
'request.resource.attr.workflowUserRoles': 'workflowUserRoles'
}
});
// yaml
- expr: >
R.attr.workflowUserRoles.exists(workflowUserRole,
workflowUserRole.userId == P.id && workflowUserRole.role == "OWNER"
)
// schema.prisma
model Workflow {
workflowUserRoles WorkflowUserRole[]
}
- 2
- 11
d
Dimitar Danailov
03/25/2024, 11:19 AM
Do you’ve a channel for jobs offers ? I’ve been looking for a new project
- 2
- 1
b
Brian Fletcher
03/26/2024, 12:38 PM
I was asked to look into an integration between backstage permissions framework and cerbos based on a conversation that took place at kubecon.
Did you guys write a backstage permissions policy that backs off to cerbos?
- 2
- 5
k
Kunal Verma
03/28/2024, 8:10 AM
Hey folks, i've actually been trying to integrate cerbos with an http server in Golang. here are a few things about my code: • it has 2 routes • a user & post database (in-memory) • an auth middleware You can find the entire code here. (P.S pls ignore the coding style as i'm a beginner in Go and just trying to understand the cerbos integration workflow 🙂)
If you see my implementation, i'm not really sure what to populate as a resource id while defining a new resource object:
Copy code
resource := cerbos.NewResource("posts", )
Apart from this, if you could pls guide me in the right direction regarding my rest of the implementation, that would mean a lot Thanks
- 3
- 6
t
Tyler Bray
03/28/2024, 3:27 PM
Hi everyone, is there a Cerbos Admin UI for Policy Management
s
- 3
- 2
a
Avinash Dalvi
04/02/2024, 7:09 AM
Cerbos playground doesn’t allow to customised files and folder structure as per wish ? Whenever I click on start from scratch it doesn’t give option to delete existing structure.
- 2
- 10
Jan Kühnlein
04/03/2024, 3:05 PM
Are there any plans on releasing @cerbos/grpc with the updated @grpc/grpc-js dependency? I’m not exactly sure bit I think we encounter the following issue with grpc-js@1.10.2 which leads to cerbos calls blocking all requests after some time: https://github.com/grpc/grpc-node/issues/2690
- 2
- 2
a
Adosh Singh
04/10/2024, 6:13 AM
I am trying to integrate cerbos with java springboot application using the java-cerbos-sdk.
it's a simple blogging application, in which there is a controller:
Copy code
@GetMapping
public ResponseEntity<?> getBlog(@RequestParam String blogId, @RequestParam String userId) {
try {
Blog blog = blogService.getBlog(blogId);
String role = DataLoader.users.get(userId).getRole();
String own = DataLoader.users.get(userId).getName();
String blogOwner = blog.getOwner();
Principal principal = Principal.newInstance(own, role);
Resource resource = Resource.newInstance("blog", blogId)
.withAttribute("owner", AttributeValue.stringValue(blogOwner));
var cerbosClient1 = new CerbosClientBuilder("localhost:3593")
.withPlaintext()
.buildBlockingClient();
System.out.println("after declearing cerbos client" + cerbosClient1);
CheckResult result = cerbosClient1.check(
principal,
resource,
"read");
System.out.println("after cerbos.Client1.check");
if (!result.isAllowed("read")) {
return ResponseEntity.status(403).body("Forbidden");
}
return ResponseEntity.ok(blog);
} catch (Exception e) {
// e.printStackTrace();
System.out.println("Error processing request: " + e.getMessage());
return ResponseEntity.internalServerError().body("Error processing request: " + e.getMessage());
}
}
When I try to hit this endpoint I am getting an error:
Copy code
Error processing request: RPC exception [Status{code=INTERNAL, description=Panic! This is a bug!, cause=java.lang.NoSuchMethodError: io.grpc.internal.Http2ClientStreamTransportState: method 'void <init>(int, io.grpc.internal.StatsTraceContext, io.grpc.internal.TransportTracer)' not found....\
```\
\
The way I integrated using [java-cerbos-sdk](https://github.com/cerbos/cerbos-sdk-java ""):\
\
I've added this in the build.gradle file:\
\
Copy code\
\
```\
dependencies {\
implementation("dev.cerbos:cerbos-sdk-java:0.+")\
implementation("io.grpc:grpc-core:1.+")\
}\
\
repositories {\
mavenCentral()\
}\
```\
\
This is how I am making the client:\
\
Copy code\
\
```\
var cerbosClient1 = new CerbosClientBuilder("localhost:3593")\
.withPlaintext()\
.buildBlockingClient();\
```\
\
I ran the cerbos server using:\
\
Copy code\
\
```\
docker run --rm --name cerbos -d -v "$(Get-Location)/cerbos/policies:/policies" -p 3592:3592 -p 3593:3593 <http://ghcr.io/cerbos/cerbos:0.34.0|ghcr.io/cerbos/cerbos:0.34.0>\
```\
\
and this successfully starts the cerbos server.\
\
Cc: **@Rohit Ghumare**\
\
\
\
- 2\
- 11\
\
s\
\
sdktr\
\
04/10/2024, 7:44 AM\
\
Hi team; are there known differences in test evaluation between Cerbos Hub and Cerbos Playground? I've seen it multiple times now, that a test suite failes in Cerbos Hub while working fine if pasted in a playground..\
\
\
\
- 2\
- 30\
\
f\
\
Fatuma A\
\
04/15/2024, 5:01 AM\
\
Hi,\
This is still an issue:\
[https://cerboscommunity.slack.com/archives/C02A364JYMQ/p1711097283739099](https://cerboscommunity.slack.com/archives/C02A364JYMQ/p1711097283739099 "")\
\
\
\
- 2\
- 3\
\
d\
\
Daniel Doornekamp\
\
04/16/2024, 4:41 AM\
\
Hi all. We migrated our Cerbos systemd service to a new system and are trying to deploy a web application that makes use of this system. We haven't changed anything in the configuration of the cerbos system **or** our web application, but are now receiving a pretty weird error in our web application:\
\
Copy code\
\
```\
Apr 16 10:38:28 system java[59202]: 10:38:28.472 [http-nio-8080-exec-5] ERROR o.a.c.c.C.[.[.[.[dispatcherServlet] - Servlet.service() for servlet [dispatcherServlet] in context with path [/rc/api] threw exception [Request processing failed; nested exception is dev.cerbos.sdk.CerbosException: RPC exception [Status{code=INTERNAL, description=Panic! This is a bug!, cause=java.lang.NoSuchMethodError: io.grpc.internal.Http2ClientStreamTransportState: method 'void <init>(int, io.grpc.internal.StatsTraceContext, io.grpc.internal.TransportTracer)' not found\
```\
\
Does anyone have a clue what could be the reason we are receiving this error?\
\
\
\
- 2\
- 27\
\
p\
\
Pratham Sikka\
\
04/18/2024, 8:54 AM\
\
Hi Team,\
I am following this repository: [https://github.com/cerbos/cerbos-aws-lambda](https://github.com/cerbos/cerbos-aws-lambda "") to integrate my application with Cerbos\
\
Copy code\
\
```\
make publish-lambda S3Bucket=<bucket-name>\
\
Deploying with following values\
===============================\
Stack name : Cerbos\
Region : None\
Confirm changeset : False\
Disable rollback : False\
Deployment s3 bucket : None\
Capabilities : ["CAPABILITY_IAM"]\
Parameter overrides : {"ArchitectureParameter": "x86_64"}\
Signing Profiles : {}\
\
Initiating deployment\
=====================\
\
Waiting for changeset to be created..\
\
CloudFormation stack changeset\
-----------------------------------------------------------------------------------------------------------------\
Operation LogicalResourceId ResourceType Replacement\
-----------------------------------------------------------------------------------------------------------------\
+ Add CerbosServerFunctionCatchA AWS::Lambda::Permission N/A\
llPermission\
+ Add CerbosServerFunctionRole AWS::IAM::Role N/A\
+ Add CerbosServerFunction AWS::Lambda::Function N/A\
+ Add ServerlessHttpApiApiGatewa AWS::ApiGatewayV2::Stage N/A\
yDefaultStage\
+ Add ServerlessHttpApi AWS::ApiGatewayV2::Api N/A\
-----------------------------------------------------------------------------------------------------------------\
\
Changeset created successfully.\
\
2024-04-18 17:49:50 - Waiting for stack create/update to complete\
\
CloudFormation events from stack operations (refresh every 5.0 seconds)\
-----------------------------------------------------------------------------------------------------------------\
ResourceStatus ResourceType LogicalResourceId ResourceStatusReason\
-----------------------------------------------------------------------------------------------------------------\
CREATE_IN_PROGRESS AWS::CloudFormation::Stack Cerbos User Initiated\
CREATE_IN_PROGRESS AWS::IAM::Role CerbosServerFunctionRole -\
CREATE_IN_PROGRESS AWS::IAM::Role CerbosServerFunctionRole Resource creation\
Initiated\
CREATE_COMPLETE AWS::IAM::Role CerbosServerFunctionRole -\
CREATE_IN_PROGRESS AWS::Lambda::Function CerbosServerFunction -\
CREATE_IN_PROGRESS AWS::Lambda::Function CerbosServerFunction Resource creation\
Initiated\
CREATE_COMPLETE AWS::Lambda::Function CerbosServerFunction -\
CREATE_IN_PROGRESS AWS::ApiGatewayV2::Api ServerlessHttpApi -\
CREATE_IN_PROGRESS AWS::ApiGatewayV2::Api ServerlessHttpApi Resource creation\
Initiated\
CREATE_COMPLETE AWS::ApiGatewayV2::Api ServerlessHttpApi -\
CREATE_IN_PROGRESS AWS::ApiGatewayV2::Stage ServerlessHttpApiApiGatewa -\
yDefaultStage\
CREATE_IN_PROGRESS AWS::Lambda::Permission CerbosServerFunctionCatchA -\
llPermission\
CREATE_IN_PROGRESS AWS::ApiGatewayV2::Stage ServerlessHttpApiApiGatewa Resource creation\
yDefaultStage Initiated\
CREATE_COMPLETE AWS::ApiGatewayV2::Stage ServerlessHttpApiApiGatewa -\
yDefaultStage\
CREATE_IN_PROGRESS AWS::Lambda::Permission CerbosServerFunctionCatchA Resource creation\
llPermission Initiated\
CREATE_COMPLETE AWS::Lambda::Permission CerbosServerFunctionCatchA -\
llPermission\
CREATE_COMPLETE AWS::CloudFormation::Stack Cerbos -\
-----------------------------------------------------------------------------------------------------------------\
\
CloudFormation outputs from deployed stack\
-----------------------------------------------------------------------------------------------------------------\
Outputs\
-----------------------------------------------------------------------------------------------------------------\
Key CerbosServerFunctionAPI\
Description API Gateway endpoint URL for Cerbos Server\
Value <value>\
\
Key CerbosServerFunctionIamRole\
Description IAM Role created for the Cerbos Server function\
Value <value>\
\
Key CerbosServerFunction\
Description Cerbos Server Function ARN\
Value <value>\
-----------------------------------------------------------------------------------------------------------------\
\
Successfully created/updated stack - Cerbos in None\
```\
\
As you can see I have been able to deploy Cerbos successfully in AWS Lambda.\
Now I want to deploy a Next.js application to AWS Lambda. I would like to understand how do I leverage the current setup to attach policies to my Next.js application which I'm deploying using AWS Lambda?\
\
\
\
\
\
\
\
- 4\
- 11\
\
p\
\
Pratham Sikka\
\
04/23/2024, 6:56 AM\
\
Hi Team,\
I am following this repository: [https://github.com/cerbos/cerbos-sdk-javascript/](https://github.com/cerbos/cerbos-sdk-javascript/ "") to build a simple HTML, CSS, and JS application and integrate Cerbos to it.\
I am getting the following error in the browser console:\
\
```\
Uncaught TypeError: Failed to resolve module specifier "@cerbos/http". Relative references must start with either "/", "./", or "../".\
```\
\
On troubleshooting I got to know that it can be an issue with how the module is imported in the client-side, and npm packages sometimes throw errors when used directly in browsers. I downloaded a build tool: Webpack, built it and now in the browser console, I get\
\
Copy code\
\
```\
cerbos-client.js:5 Uncaught Error: Cannot find module '@cerbos/http'\
at webpackMissingModule (cerbos-client.js:5:50)\
at eval (cerbos-client.js:5:137)\
at ./cerbos-client.js (bundle.js:19:1)\
at __webpack_require__ (bundle.js:53:41)\
at eval (index.js:2:75)\
at ./index.js (bundle.js:29:1)\
at __webpack_require__ (bundle.js:53:41)\
at bundle.js:93:37\
at bundle.js:95:12\
webpackMissingModule @ cerbos-client.js:5\
eval @ cerbos-client.js:5\
./cerbos-client.js @ bundle.js:19\
__webpack_require__ @ bundle.js:53\
eval @ index.js:2\
./index.js @ bundle.js:29\
__webpack_require__ @ bundle.js:53\
(anonymous) @ bundle.js:93\
(anonymous) @ bundle.js:95\
index.html:1 Uncaught TypeError: Failed to resolve module specifier "@cerbos/http". Relative references must start with either "/", "./", or "../".\
```\
\
I would like to understand how to connect Cerbos using cerbos/http package and can grpc also be used, because in the repository linked above, it is written that for browser-based applications, cerbos/http provides a client for interacting with Cerbos PDP\
\
\
\
- 2\
- 3\
\
p\
\
Pratham Sikka\
\
04/23/2024, 6:58 AM\
\
This is the code in the cerbos-client.js file which is responsible for connection between Cerbos and the application\
\
Copy code\
\
```\
import { HTTP } from "@cerbos/http";\
\
const cerbos = new HTTP("<http://localhost:3592>");\
\
export default cerbos;\
```\
\
j\
\
Joe Cantwell\
\
04/23/2024, 7:34 AM\
\
Hey guys,\
I’ve a question related to some of the Go sample code for instantiating a connection to cerbos. I have a gin based API that will use cerbos under the hood and I’m not sure if the go sdk client can be a singleton or not\
\
Copy code\
\
```\
crb, err := cerbos.New(c.CerbosAPI, cerbos.WithPlaintext())\
```\
\
I’m wondering if I can instantiate this in main and treat the\
\
```\
*cerbos.GRPCClient\
```\
\
pointer as a singleton (add it to my handler struct) or would it be better to instantiate it prior to each call to\
\
```\
IsAllowed\
```\
\
or whatever ( which makes testing a bit tricker)?\
\
\
\
- 2\
- 1\
\
s\
\
sdktr\
\
04/23/2024, 1:01 PM\
\
Anyone aware of a cerbos integration from django? Where Cerbos can help filter out the data queries based on user permissions? Case in point: Netbox\
\
\
\
- 2\
- 1\
\
m\
\
Mitch\
\
05/08/2024, 5:54 PM\
\
Hello!\
\
I was hoping someone could help me understand why I'm getting a\
\
```\
more than one YAML document detected\
```\
\
error when running tests with cerbos?\
\
👍🏼 1\
\
\
\
\
\
- 3\
- 12\
\
v\
\
Vu Bui\
\
05/09/2024, 7:44 AM\
\
Hi,\
\
I have a use case and hope that anyone here has experience or can help with. I'm building a multi-tenant SaaS platform where we have system-defined roles in each of the tenant. Users joining to a tenant must have a role. Each role will have an entire permission set to access the system.\
\
I want to allow users to customize the permissions of the roles, and even create their own roles. I'm planning to use Cerbos for this. My thinking policy model would be defining the default roles in the root scope. Then each of the tenant that has customization, I'll populate policies to the child scope, identified by scope ID. So the layout would be like\
\
Copy code\
\
```\
resource_policies\
|-- tenant_1\
| |-- resource_1.yaml\
|-- tenant_2\
| |-- resource_1.yaml\
|-- resource_1.yaml\
```\
\
My question is, is this a scalable solution? I'm thinking like how would it end up if I have a lot of tenants with customized roles and permissions? Would it be a problem for Cerbos since the policy will be huge. Also, whenever there is a tenant customizing their roles, I have to reload Cerbos PDP. Would it only reload what is changed or the whole structure?\
\
Thanks\
\
\
\
- 2\
- 4\
\
n\
\
Nicholas Tuck\
\
05/09/2024, 11:38 AM\
\
Hi, I'm new, I'm learning. Watched [this recent pinned video](https://cerboscommunity.slack.com/archives/C0286P04ZBR/p1713168005313639 "") just now and a question crossed my mind:\
\
• In the example, the "manager" role can only approve expenses <$500, then changes it later to <$1000, this makes sense.\
• How would you recommend supporting if that $ amount was variable, a setting that could be changed in the app by an admin for example? So it couldn't be hard coded in the policy?\
\
\
\
- 2\
- 6\
\
v\
\
Vish\
\
05/10/2024, 12:58 AM\
\
hello, i'm trying to use the cerbos pdp in a sidecar alongside my application container in a k8s pod. The issue i'm running into is that the\
\
```\
cerbos.sock\
```\
\
file that cerbos pdp is listening to in my shared volume is owned by\
\
```\
root\
```\
\
, but my application is running under the\
\
```\
node\
```\
\
user and group and is getting a\
\
```\
EACCES\
```\
\
error when trying to access the\
\
```\
cerbos.sock\
```\
\
file, how can i go about resolving this? I have verified by executing a shell as root user and manually changing the file ownership with \`chown\`in my application container to the\
\
```\
node\
```\
\
user and group resolves the error. Thanks\
\
\
\
\
\
- 3\
- 5\
\
n\
\
Nicholas Tuck\
\
05/10/2024, 12:26 PM\
\
Is there a way to do optional chaining with CEL/Cerbos Policies? JS syntax:\
\
```\
<http://P.attr.org?.companies?.[role]|P.attr.org?.companies?.[role]> === "owner"\
```\
\
\
\
- 2\
- 3\
\
m\
\
Mitch\
\
05/14/2024, 5:24 PM\
\
Guidance Needed around scopes, I'm not sure if I'm thinking about them wrong or if what I'm trying to do isn't supported...\
\
I want to enforce a\
\
```\
companyX.exec.manager\
```\
\
scope chain. However, that scope is specific to the principal. Do I add that scope to the resource when sending the PDP request? Technically, sure, that should work right, but what am I missing conceptually on why we would have to send that "principal" scope to the resource?\
\
\
\
- 2\
- 8\
\
j\
\
Jithin Zachariah\
\
05/15/2024, 9:50 AM\
\
Hey folks, quick question regarding auxData [https://docs.cerbos.dev/cerbos/latest/configuration/auxdata.html](https://docs.cerbos.dev/cerbos/latest/configuration/auxdata.html ""). The document only mention the JWT as the source of external data. Does Cerbos support referencing other data sources, like external API, DBs, or does it have a data store where we could store some data required for policy evaluation.\
\
\
\
- 2\
- 5\
\
m\
\
Mitch\
\
05/16/2024, 2:33 PM\
\
Can someone help me understand what benefits/functionality I would get by making a hierarchical resource name in a policy?\
\
[https://docs.cerbos.dev/cerbos/latest/policies/authoring\_tips#\_policy\_structure](https://docs.cerbos.dev/cerbos/latest/policies/authoring_tips#_policy_structure "")\
\
\
\
- 2\
- 6\
\
y\
\
Yehiel Mizrahi\
\
05/19/2024, 5:32 AM\
\
Hi guys! Need some help with clarifying requirements for MySql server as a storage for Cerbos. After looking at [https://docs.cerbos.dev/cerbos/latest/configuration/storage.html#mysql](https://docs.cerbos.dev/cerbos/latest/configuration/storage.html#mysql "") seen nothing related to MySql machine config (MySql version, memory / CPU etc.) - only configuration details related to Cerbos connection to MySql machine. Are there any special requirements on MySql server itself (for optimal performance, of course)?\
\
\
\
- 2\
- 4\
\
a\
\
Akhil Chouhan\
\
05/20/2024, 9:01 AM\
\
Hi guys,\
\
I've set up a Cerbos cluster on my localhost and I'm working on replicating the finance application sample provided in the Cerbos playground:\
\
[Finance Application Sample](https://play.cerbos.dev/p/XhkOi82fFKk3YW60e2c806Yvm0trKEje?utm_source=website "")\
\
I successfully created the resource policy and verified that I can retrieve it using the GET REST call. However, when I provide the same principal to the policy in my localhost environment, I consistently receive a "deny" response for all actions. This behavior differs from the results I get using the playground with the same principal.\
Upon debugging, I noticed that there are\
\
```\
derived_roles\
```\
\
defined in the\
\
```\
common_roles.yaml\
```\
\
file, which are referenced in the resource policy. It appears that these derived roles are crucial for the policy evaluation.\
\
My question is: How can I upload the\
\
```\
common_roles.yaml\
```\
\
to my localhost setup? Is there an API endpoint for uploading common roles? I couldn't find relevant documentation for this.\
Any guidance on this issue would be greatly appreciated.\
\
Thanks!\
\
\
\
\
\
- 2\
- 9\
\
a\
\
Amarachi Aso\
\
05/20/2024, 3:03 PM\
\
Hi 👋\
\
I’m working on a blog post where I talk about cerbos metrics, but need some help.\
\
My question is about the cerbos metrics as seen on the\
\
```\
/_cerbos/metrics\
```\
\
endpoint. Can I get some explanation on what those metrics mean? For example, what does the metric\
\
```\
cerbos_dev_index_entry_count\
```\
\
mean? The help text says it's the "Number of entries in the index", but I still do not know what this means. This goes for the other two custom metrics\
\
```\
cerbos_dev_cache_max_size\
```\
\
and,\
\
```\
cerbos_dev_store_poll_count_total\
```\
\
.\
\
Why would a customer or a user hosting the Cerbos PDP be interested in these metrics?\
\
\
\
\
\
- 2\
- 1\
\
a\
\
Andy\
\
05/23/2024, 8:52 AM\
\
Hello! I'm wondering if someone would be able to offer me a bit of guidance around policies 🙏 The scenario we're in is a service that has principals made up of service accounts and real people. All principals are supplied by an oauth2 service and follow the same schema. I'm looking for guidance on best practices here.\
\
What I've considered so far is:\
\
\- A separate principal policy for each service account across each environment. From a scalability POV that scared me, as the UUIDs _could_ change, or at least are not known until they are provisioned, so would require actively managing. The IDs also vary across environment, so we would need a separate policy for each one.\
\- Use roles and assign unique roles to the SA. My concern here is that we did this in our last access management solution and it resulted hundreds of very granular permissions, which was hard to manage.\
\
I'm sure there's an option that I've missed and I'm not seeing 🙈\
\
\
\
- 2\
- 5\
\
r\
\
Razi Ahmad\
\
05/23/2024, 9:17 AM\
\
Hi, I am trying to integrate git to fetch policy in the sidecar but getting the following error\
\
Copy code\
\
```\
logger":"cerbos.git.store","message":"Failed to initialize git store","dir":"//tmp/work/policies","error":"failed to clone from <http://github.xyz/xyz/apo.git|github.xyz/xyz/apo.git> to //tmp/work/policies: exec: \"git\": executable file not found in $PATH"}\
{"log.level":"error","@timestamp":"2024-05-23T11:24:52.171Z","log.logger":"cerbos.server","message":"Failed to start server","error":"failed to create store: failed to clone from <http://github.xyz/xyz/apo.git|github.xyz/xyz/apo.git> to //tmp/work/policies: exec: \"git\": executable file not found in $PATH"}\
{"log.level":"info","@timestamp":"2024-05-23T11:24:52.171Z","log.logger":"cerbos.server","message":"maxprocs: Resetting GOMAXPROCS to 8"}\
cerbos: error: failed to create store: failed to clone from <http://github.xyz/xyz/apo.git|github.xyz/xyz/apo.git> to //tmp/work/policies: exec: "git": executable file not found in $PATH\
```\
\
and this is my config map\
\
Copy code\
\
```\
apiVersion: v1\
kind: ConfigMap\
metadata:\
name: cerbos-sidecar-demo\
data:\
".cerbos.yaml": |-\
server:\
# Configure Cerbos to listen on a Unix domain socket.\
httpListenAddr: "unix:/sock/cerbos.sock"\
storage:\
driver: "git"\
git:\
protocol: https\
url: <http://github.xyz/xyz/apo.git|github.xyz/xyz/apo.git>\
branch: main\
subDir: policies\
checkoutDir: ${HOME}/tmp/work/policies\
updatePollInterval: 60s\
operationTimeout: 30s\
https:\
username: xyz\
password: *******\
```\
\
👋 1\
\
\
\
\
\
- 3\
- 14\
\
y\
\
Yehiel Mizrahi\
\
05/26/2024, 6:28 AM\
\
Hi,\
I have a few questions regarding Cerbos sidecar deployment (as presented in [https://docs.cerbos.dev/cerbos/latest/deployment/k8s-sidecar.html](https://docs.cerbos.dev/cerbos/latest/deployment/k8s-sidecar.html "")) according to the requirements I have received:\
1\. I need the main app and Cerbos to communicated via IPC. Do I need a special config for that or its automatically achieved by using "localhost" from the main app? Note that external apps (outside the sidecar) should not have access to Cerbos.\
2\. Which is the preferred way: to build a docker image with Cerbos or install Cerbos on docker build?\
3\. I have several apps that will be with Cerbos in sidecar deployment, meaning that there will be a one sidecar deployment with app1 and Cerbos, another with app2 and Cerbos etc. and all of Cerbos instances will communicate with the same DB. The question is how to run these different sidecars with different configs for Cerbos: for example, I want Admin API enable in one sidecar and disable on the other.\
4\. Is there any way to test the sidecar deployment locally? (I am running a Windows machine).\
Prod environment is AWS (EKS)\
\
Any other useful comments are appreciated. I understand that most of the questions can be easily answered by docker / k8s experts, unfortunately, I don't have mush experience in that area.\
\
Thanks!\
\
\
\
- 2\
- 1\
\
o\
\
Oliver Nixon\
\
06/07/2024, 11:19 AM\
\
Hi,\
We're looking to use Cerbos and Cerbos Hub to secure our multi-tenant application. I don't think that the multi-tenant samples I've found would be flexible enough for our needs (users can me members of multiple tenants and have different permissions in each) and so I'm currently exploring the "SaaS Analytics Workspaces" sample as an option.\
\
Couple of questions...\
• I guess firstly, is that a good idea for representing tenants rather than workspaces? What should I be weary of?\
• How would the principal workspaces object from the sample be represented in a schema? (highlighted red in the screenshot)\
I'm suffering from staring at a blank page so it would be good to get some basics sorted which we can build on.\
\
Thanks in advance.\
\
\
\
\
\
- 2\
- 2\
\
r\
\
Roman Levytskyi\
\
06/10/2024, 10:23 AM\
\
Hi there\
We’re having trouble adding/replacing conditions for the policy\
\
the problem is:\
• the policy exists\
• i add 2 conditions\
• i retrieve the policy - it has 2 conditions\
• i update policy and send these same conditions again\
• get the policy - now we have 4 duplicated conditions\
• ….\
• send 2 conditions again and there are now 6, 8, 12 …\
from what i see there’s no way to provide a unique reference that Cerbos can distinguish them\
am i doing sth wrong or is it Cerbos issue?\
\
\
\
- 2\
- 11\
\
j\
\
Jonathan Janisch\
\
06/25/2024, 11:24 AM\
\
Hi all. I'm just getting started with Cerbos. I've read through most of the quickstart and have been testing with curl. But now that I'm trying to get it integrated into our app I'm having all sorts of problems with grpc. We are using Quarkus.\
\
I created a basic quarkus hello world starter project which uses the latest Quarkus (3.11.x):\
\
Copy code\
\
```\
quarkus create && cd code-with-cerbos\
```\
\
I modified the basic GreetingResource endpoint with the\
\
```\
CerbosBlockingClient\
```\
\
sample code and that all compiles fine.\
\
I modified pom.xml dependencies:\
\
Copy code\
\
```\
<dependency>\
<groupId>dev.cerbos</groupId>\
<artifactId>cerbos-sdk-java</artifactId>\
<version>0.12.0</version>\
</dependency>\
<dependency>\
<groupId>io.grpc</groupId>\
<artifactId>grpc-core</artifactId>\
<version>1.63.0</version>\
<scope>runtime</scope>\
</dependency>\
```\
\
I'm not familiar with grpc. I've tried various scopes with grpc-core and nothing seemed to fix the issue.\
\
When I hit that endpoint I'm getting:\
\
Copy code\
\
```\
__ ____ __ _____ ___ __ ____ ______\
--/ __ \/ / / / _ | / _ \/ //_/ / / / __/\
-/ /_/ / /_/ / __ |/ , _/ ,< / /_/ /\ \\
--\___\_\____/_/ |_/_/|_/_/|_|\____/___/\
2024-06-25 11:12:45,827 INFO [io.quarkus] (Quarkus Main Thread) code-with-quarkus 1.0.0-SNAPSHOT on JVM (powered by Quarkus 3.11.3) started in 2.605s. Listening on: <http://localhost:8080>\
\
2024-06-25 11:12:45,830 INFO [io.quarkus] (Quarkus Main Thread) Profile dev activated. Live Coding activated.\
2024-06-25 11:12:45,831 INFO [io.quarkus] (Quarkus Main Thread) Installed features: [cdi, rest, smallrye-context-propagation, vertx]\
2024-06-25 11:13:05,979 ERROR [io.qua.ver.htt.run.QuarkusErrorHandler] (executor-thread-1) HTTP Request to /hello/ failed, error id: 0b17d221-b74b-409d-b605-28103aba9d4b-1: java.lang.NoClassDefFoundError: com/google/protobuf/RuntimeVersion$RuntimeDomain\
at dev.cerbos.api.v1.engine.Engine$Principal.<clinit>(Engine.java:15736)\
at dev.cerbos.sdk.builders.Principal.<init>(Principal.java:17)\
at dev.cerbos.sdk.builders.Principal.newInstance(Principal.java:21)\
at org.acme.GreetingResource.hello(GreetingResource.java:26)\
at org.acme.GreetingResource$quarkusrestinvoker$hello_e747664148511e1e5212d3e0f4b40d45c56ab8a1.invoke(Unknown Source)\
at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)\
at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)\
at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)\
at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:599)\
at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2516)\
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2495)\
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1521)\
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)\
at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)\
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)\
at java.base/java.lang.Thread.run(Thread.java:1583)\
Caused by: java.lang.ClassNotFoundException: com.google.protobuf.RuntimeVersion$RuntimeDomain\
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)\
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)\
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)\
at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:526)\
at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:476)\
```\
\
t\
\
- 2\
- 5\
\
d\
\
Danylo Vivchar\
\
06/27/2024, 4:15 AM\
\
Hey folks, is there a java / scala client for Admin HTTP API? we want to use UDS for a communication with a sidecar and I found out that java sdk has only gRPC support for Admin API, which is not working over UDS for java library.\
\
\
\
- 2\
- 2\
\
j\
\
Jonathan Janisch\
\
06/27/2024, 10:27 AM\
\
hi all, I'm just getting started with Cerbos. I've read through the guide on multi-tenancy: [https://www.cerbos.dev/blog/implementing-cerbos-in-a-multitenant-system](/content/blog/implementing-cerbos-in-a-multitenant-system ""/index.html). I probably need to sit down and go through it a bit deeper. I guess my main concern at a high level is I expected to see policy files organized at a tenant level, e.g\
\
```\
/policies/<tenant-id>/\
```\
\
, but that guide organized it differently. So at the root level, I expected you may have some basic rules, e.g. user [--](https://community.cerbos.dev/c/-- "") tenant rules, but policies are completely tenant specific. And then I assumed via Cerbos Hub, we might allow our clients to self-administer their tenant specific policies. Once again I'm just getting started, but since I don't see a major link in the Cerbos Hub docs on multi-tenancy, I would imagine it does not support what I was envisioning.\
\
Some context. I work in the mortgage industry. One of our products is for originating loans. One of the core attributes that affects policy decisions is the loan's status (e.g. is it active, in underwriting, closing, post closing, etc). All of our clients will have different roles depending on their size, e.g. maybe as few as 10 roles and as many as 100). And each client will have completely different configurations for each resource/role combo, e.g. "This resource can be updated only when loan is between active and underwriting statuses, but a senior manager can update it into closing" while other tenants may have different rules.\
\
We're launching a new product where I'm trying to utilize cerbos and I'm trying to get a handle on how the configuration will scale when we have N tenants. Any followup article I should take a look at? I think I just need to dive in a bit more to see how to properly organize this. Thanks\
\
\
\
- 2\
- 2\
\
j\
\
Jonathan Janisch\
\
06/30/2024, 8:45 PM\
\
Sorry for the long post. I've been struggling a bit to think of how to model policies. I think it's because I would intuitively think to model this hierarchy:\
\
Copy code\
\
```\
Acme\
┌── ───────┐\
▼ ▼\
Internal Customers\
┌─── │ │\
▼ ▼ ▼\
Eng Sales WileECoyote\
┌─── │ ────┐\
▼ ▼ │\
AMER EMEA APAC\
```\
\
With a scope like\
\
```\
acme.internal.sales.apac\
```\
\
And I would intuitively think some resource policy at that scope should only be permitted if and only if each "node" when AND'ed together permitted the request. In fact, this is essentially what I'm doing in our apps' API currently without Cerbos. But this is not how Cerbos works. Cerbos evaluates scopes starting from the most specific to least specific and the **first match wins**.\
\
So a policy file such as\
\
```\
resource/acme/internal/sales/apac/user.yaml\
```\
\
is\
extremely dangerous as this policy could easily have an EFFECT\_ALLOW that basically ignored and bypassed all parent levels (e.g. allowing a principal that is not internal to delete a user). Of course we can create unit tests, but now your unit test for an APAC resource would have to have all permutations of the hierarchy in order to ensure it doesn't accidentally grant access.\
\
This scope modeling only seems to work if your leaf nodes (more specific nodes) only have EFFECT\_DENY defined. I can see that's how the multi-tenant sass recipe was done here: [https://github.com/cerbos/demo-multitenant-saas/blob/main/policies/resource/regional/purchase\_order.yaml](https://github.com/cerbos/demo-multitenant-saas/blob/main/policies/resource/regional/purchase_order.yaml "") where purchase orders are denied if the resource is NOT in the principal's allowed regions. But it seems to go against how authz should be defined in that everything should be DENY by default unless explicitly allowed. But here we have to model our policies as ALLOWing unless explicitly DENIED. Also, in the github example, it seems we would have to repeat this regional check on all resources which seems error prone.\
\
Our app doesn't have such complex needs **currently** as we're about to launch our initial MVP, but the other products at our org do and we will surely have such requirements in the future. So this isn't really a call for assistance as much as just a stream of thoughts. I guess my big fear is let's say we're 3 years in with all small volume clients and then we land a big client in which the complexity causes us to remodel all of our existing clients' policies!\
\
\
\
- 2\
- 7\
\
i\
\
inbar dor\
\
07/07/2024, 2:27 AM\
\
Hi, we are just getting started with Cerbos and I have a question\
We are saving our custom role as a condition in the resource policy and and we want to update the policy each change by calculating it every change (we are using the condition to check the custom role and the relevant tenant).\
I'm wondering if there is a way to save the policy in multiple files by roles and by that we will be able to update only the relevant role's files and not the whole policy.\
\
\
\
- 2\
- 4\
\
\
\
Jesum Yip\
\
07/08/2024, 1:29 AM\
\
hello! I use the Python SDK to call Cerbos. Whenever I get a reply, I see a class of type\
\
```\
CheckResourcesResult\
```\
\
which has a property called\
\
```\
result\
```\
\
which holds an instance of\
\
```\
Resource\
```\
\
class. In that instance of\
\
```\
Resource\
```\
\
class, I see that the\
\
```\
attr\
```\
\
property is an empty dictionary. Is this supposed to be empty or are there circumstances where this will be filled up? the reason I am asking is this: i set my\
\
```\
kind\
```\
\
to be a global value of\
\
```\
service:fields.\
```\
\
I am using cerbos to control which fields in a database get obfuscated when a REST API returns it. the way I differentiate the fields (or specify the field names) in the cerbos API payload is via an attribute to the resource. I call this attribute\
\
```\
field_name\
```\
\
\
\
- 2\
- 6\
\
j\
\
Jonah Eisen\
\
07/08/2024, 1:39 PM\
\
Hi, I'm trying to load policies into Cerbos using the admin API with the Python SDK. Is there a way to load the policies from a file similar to the cli command\
\
```\
cerbosctl put policy ./path/to/policy.yaml\
```\
\
? Looks like the\
\
```\
add_or_update_policy\
```\
\
function takes schema objects...\
\
\
\
\
\
- 3\
- 5\
\
\
\
Jesum Yip\
\
07/10/2024, 4:45 AM\
\
does the resource field in a cerbos policy support wildcards?\
\
\
\
- 2\
- 9\
\
m\
\
Mads Baadsmand\
\
07/15/2024, 4:47 AM\
\
Hello,\
Is it possible to source policies from two sources? like a git repositories for static policies and a database for user created policies?\
\
\
\
- 2\
- 1\
\
m\
\
Mads Baadsmand\
\
07/16/2024, 4:49 PM\
\
[https://github.com/cerbos/cerbos/tree/feat/role-policies](https://github.com/cerbos/cerbos/tree/feat/role-policies "")\
I'm having some issues building and running this branch.\
\
• When i run\
\
```\
make lint\
```\
\
it complains about missing types in some role-policy related files\
• When i run\
\
```\
make build\
```\
\
it complains about something with docker-format for\
\
```\
generate-api-docs\
```\
\
.\
• When i run\
\
```\
make build\
```\
\
(commenting out documentation, and linting) it fails several tests\
• When i run\
\
```\
make build\
```\
\
(commenting out above plus testing) I get a docker image I can run.\
◦ it recognizes a rolePolicy document, but I cannot make it return an\
\
```\
EFFECT_ALLOW\
```\
\
I'm sure i'm missing something in my process. Can anyone enlighten me?\
\
\
\
\
\
- 3\
- 10\
\
f\
\
Felix Ombura\
\
07/20/2024, 4:00 AM\
\
Hello, I'm trying to implement cerbos in my node application. For development, I'm running the cerbos instance with docker-compose\
\
Copy code\
\
```\
cerbos:\
image: ghcr.io/cerbos/cerbos:latest\
container_name: cerbos_service\
ports:\
- '3592:3592'\
- '3593:3593'\
volumes:\
- ./cerbos/policies:/cerbos-service/policies\
- ./cerbos/config.yaml:/cerbos-service/config.yaml\
command: ['server', '--config=/cerbos-service/config.yaml']\
environment:\
- CERBOS_ADMIN_USERNAME=${CERBOS_ADMIN_USERNAME}\
- CERBOS_ADMIN_PASSWORD_HASH=${CERBOS_ADMIN_PASSWORD_HASH}\
networks:\
- core_network\
```\
\
My cerbos config file is as below\
\
Copy code\
\
```\
import { GRPC as Cerbos } from '@cerbos/grpc';\
import { logger } from '../utils/logger';\
import EnvConfiguration from './env';\
\
function createCerbosClient(): Cerbos {\
const { CERBOS_HOST, CERBOS_PORT, CERBOS_TLS, CERBOS_PLAYGROUND_INSTANCE } = EnvConfiguration;\
\
logger.info('Initializing Cerbos client with the following configuration:', {\
CERBOS_HOST,\
CERBOS_PORT,\
CERBOS_TLS,\
CERBOS_PLAYGROUND_INSTANCE,\
});\
\
if (!CERBOS_HOST) {\
const error = new Error('CERBOS_HOST is not set');\
logger.error(error.message);\
throw error;\
}\
\
if (!CERBOS_PORT) {\
const error = new Error('CERBOS_PORT is not set');\
logger.error(error.message);\
throw error;\
}\
\
try {\
const cerbosClient = new Cerbos(`${CERBOS_HOST}:${CERBOS_PORT}`, {\
tls: CERBOS_TLS,\
playgroundInstance: CERBOS_PLAYGROUND_INSTANCE,\
});\
\
logger.info('Cerbos client created successfully');\
return cerbosClient;\
} catch (error) {\
logger.error('Failed to initialize Cerbos client:', error);\
throw error;\
}\
}\
\
class CerbosClient {\
private static instance: Cerbos | null = null;\
\
private constructor() {}\
\
public static getInstance(): Cerbos {\
if (!CerbosClient.instance) {\
logger.info('Creating a new Cerbos client instance');\
CerbosClient.instance = createCerbosClient();\
logger.info('Cerbos client initialized successfully');\
} else {\
logger.info('Using existing Cerbos client instance');\
}\
\
return CerbosClient.instance;\
}\
}\
\
export default CerbosClient.getInstance();\
```\
\
However, I get the error\
\
Copy code\
\
```\
Authorization error: gRPC error 14 (UNAVAILABLE): Name resolution failed for target dns:cerbos_service:3592 {\
core_service | "code": 14,\
core_service | "details": "Name resolution failed for target dns:cerbos_service:3592",\
core_service | "name": "NotOK",\
core_service | "stack": "NotOK: gRPC error 14 (UNAVAILABLE): Name resolution failed for target dns:cerbos_service:3592\n at Object.callback (/app/node_modules/@cerbos/grpc/src/transport.ts:75:15)\n at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/src/client.ts:360:26)\n at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/src/client-interceptors.ts:458:34)\n at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/src/client-interceptors.ts:419:48)\n at /app/node_modules/@grpc/grpc-js/src/resolving-call.ts:163:24\n at processTicksAndRejections (node:internal/process/task_queues:77:11)"\
core_service | }\
```\
\
How can I resolve this? Any help from here?\
\
\
\
- 2\
- 5\
\
j\
\
Johnathan Koppang\
\
07/23/2024, 9:41 PM\
\
Hello! How do I know if JWKS/JWT is working? I am still getting normal responses from the base API even when I don't provide a key.\
\
\
\
- 2\
- 4\
\
j\
\
Jakub S\
\
07/25/2024, 4:19 PM\
\
hi there. I am looking into cerbos and it looks really nice, but I can't find info whether it can provide answer to questions like what actions is user allowed to do on resource\
\
\
\
- 2\
- 2\
\
j\
\
Jonathan Janisch\
\
07/26/2024, 12:45 AM\
\
Any reason why we cannot use resource scope directly in a condition?\
\
Copy code\
\
```\
hierarchy(request.principal.attr.tenantId)\
.overlaps(hierarchy(request.resource.scope))\
```\
\
> Invalid expression \`hierarchy(request.principal.attr.tenantId).overlaps(hierarchy(request.resource.scope))\`: \[undefined field 'scope'\] (invalid expression)\
\
The hierarchy CEL examples in the docs show scope in the attributes object, but then you have to duplicate the scope:\
\
Copy code\
\
```\
"principal": {\
"id": "john",\
"roles": ["employee"],\
"attr": {\
"tenantId": "tenant1"\
}\
},\
"resource": {\
"kind": "leave_request",\
"scope": "tenant1.foo.bar",\
"attr": {\
"scope": "tenant1.foo.bar"\
}\
}\
```\
\
\
\
- 2\
- 2\
\
o\
\
Oliver Nixon\
\
07/29/2024, 4:56 AM\
\
Is anyone able to help with building a condition for the below please?\
\
Resource has multiple tags:\
\
Copy code\
\
```\
id: near-miss#1\
kind: near-miss:object\
attr:\
org: org1\
address: address1\
tags: ["tag2", "tag4"]\
```\
\
Principal is a member of multiple organizations and can be assigned roles for different tags:\
\
Copy code\
\
```\
id: user#1\
roles:\
- user\
attr:\
organizations:\
org1:\
tags:\
tag1: ["siteSafety"]\
tag2: ["roleA", "roleB", "roleC"]\
tag4: ["roleA", "siteSafety"]\
org2:\
tags:\
tag3: ["siteSafety"]\
```\
\
The above Principal is in the\
\
```\
siteSafety\
```\
\
role for tags\
\
```\
1\
```\
\
and\
\
```\
4\
```\
\
.\
\
We need a condition that will check the Principal org tags, matching the Resource org (\
\
```\
P.attr.organizations[<http://R.attr.org|R.attr.org>].tags\
```\
\
), and then check that there is a matching Principal tag with the\
\
```\
siteSafety\
```\
\
role.\
\
e.g. From the above example, the Resource is for org 1 and has tags 1 and 4. The Principal has an org1 attribute with tags 1, 2, & 4. tag4 has a siteSafety role so the result is ALLOW.\
\
\
\
- 2\
- 1\
\
n\
\
Nisto Uhami\
\
07/31/2024, 12:26 AM\
\
New to cerbos, How to check for permissions when listing resources?\
\
\
\
- 2\
- 8\
\
s\
\
Siddhant Prateek\
\
08/03/2024, 12:40 PM\
\
Hi, is there any cerbos sample example where Basic Auth is Enabled in Cerbos config, so this my\
\
```\
conf.yaml\
```\
\
, but\
\
Copy code\
\
```\
server:\
#grpcListenAddr: "unix:/tmp/sock/cerbos.grpc"\
#httpListenAddr: "unix:/tmp/sock/cerbos.http"\
adminAPI:\
enabled: true\
adminCredentials:\
username: admin\
passwordHash: JDJ5JDEwJEU2V2ExLmVCSFdMUXhQZWtxVnJPeGVWNDFjMEhBR1JBd3d0SXNjbDlwZ2k2UWhOVlM4cXkuCgo=\
grpcListenAddr: ':3593'\
httpListenAddr: ':3592'\
\
storage:\
disk:\
directory: /policies\
watchForChanges: true\
driver: disk\
```\
\
• i've added the configuration, but it's not enabling the basic auth, i'm not sure what is the issue\
\
\
\
\
\
- 3\
- 7\
\
m\
\
Matheus Cabral\
\
08/07/2024, 11:12 AM\
\
Hi, I'm trying to configure cerbos and I'm getting the following error when trying to add a policy:\
Configured store is not mutable\
\
This is my configuration file:\
\
Copy code\
\
```\
server:\
grpcListenAddr: "unix:/opt/cerbos.grpc"\
httpListenAddr: "unix:/opt/cerbos.http"\
udsFileMode: 0o766\
adminAPI:\
enabled: true\
adminCredentials:\
username: cerbos\
passwordHash: {password}\
\
engine:\
defaultPolicyVersion: "default"\
\
auxData:\
jwt:\
keySets:\
- id: cognito_IDP\
remote:\
url: <https://cognito-idp>.${AWS_DEFAULT_REGION}.<http://amazonaws.com/#${COGNITO_USER_POOL_ID}/.well-known/jwks.json|amazonaws.com/#${COGNITO_USER_POOL_ID}/.well-known/jwks.json>\
storage:\
driver: "blob"\
blob:\
bucket: s3://${BUCKET_S3}?region=${AWS_DEFAULT_REGION}\
prefix: policies\
workDir: ${HOME}/tmp/cerbos/work\
updatePollInterval: 15s\
downloadTimeout: 30s\
requestTimeout: 10s\
```\
\
\
\
\
\
- 3\
- 10\
\
t\
\
test-cerbos-nestjs\
\
08/14/2024, 3:55 AM\
\
Hi, I would highly appreciate any assistance with the Cerbos integration.\
I’m not receiving a success response even when the user is authorized.\
I’ve encountered issues with this [sample repository](https://github.com/cerbos/nestjs-cerbos ""), which resulted in failed E2E tests, and attempts to test with Postman also didn't work. It’s possible I’ve overlooked something, and I’ve spent considerable time debugging without resolution. Your help would be greatly appreciated.\
\
\
\
\
\
\
\
- 3\
- 51\
\
d\
\
Dimitris Bouras\
\
08/14/2024, 5:36 AM\
\
Hi, I understand that one can map the resource policies 1:1 to each data set, Could the cerbos pdp respond to questions get all dataset user xxx has access to?\
\
\
\
- 2\
- 8\
\
k\
\
Kevin Nguyen\
\
08/14/2024, 6:31 PM\
\
Hi I'm wondering whether using hasIntersection between a list and a map works? Will the items of a list be compared with the keys of a map?\
\
\
\
- 2\
- 10\
\
m\
\
Mohit Yadav\
\
08/18/2024, 5:25 AM\
\
Hi Cerbos team, is there any recommended UI library to manage cerbos policies effectively and communicate with cerbos admin API's?\
\
My use case i would like to provide a UI to manage cerbos policies, since it is plain JSON, i am wondering if there is a recommended tool or ui package that translates cerbos JSON rules with least UI expertise.\
\
\
\
d\
\
- 3\
- 2\
\
n\
\
Nikhil Ch\
\
08/20/2024, 1:33 AM\
\
Hello I am trying to deploy cerbos the issue I am facing is that while our pod is showing as healthy without any errors, we are facing problems when trying to expose it via ingress. Specifically, the target group associated with the load balancer is not reaching a healthy state. Can you please help with it ?\
\
\
\
p\
\
+2\
\
- 5\
- 61\
\
j\
\
Jonathan Janisch\
\
08/20/2024, 10:06 AM\
\
I have a policy that I think might be simplified with some additional features added to Cerbos. But perhaps there is already a better way.\
\
Let's say I'm creating the authz for a ticketing system like JIRA. Now I want to restrict which roles can "update". I essentially want to do this:\
\
Copy code\
\
```\
if (ticketStatus in ["OPEN", "STARTED"]) {\
if (role in [A,B]) -> EFFECT_ALLOW\
} else if (ticketStatus in ["RESOLVED"]) {\
if (role in [C,D,E]) -> EFFECT_ALLOW\
} else {\
if (role in [F,G]) -> EFFECT_ALLOW\
}\
```\
\
So for certain ticket statuses, only certain roles can do an "update". That's dead simple in Cerbos. The problem is the else branch. The else branch is only executed when the ticket status is not OPEN, STARTED, or RESOLVED. But I do not want to have to repeat that condition in another rule.\
\
Here's how I've handled it:\
\
Copy code\
\
```\
variables:\
local:\
conditionA: R.attr.status in ["OPEN", "STARTED"]\
conditionB: R.attr.status == "RESOLVED"\
rules:\
- actions:\
- "update"\
effect: EFFECT_ALLOW\
roles:\
- A\
- B\
condition:\
match:\
expr: V.conditionA\
\
- actions:\
- "update"\
effect: EFFECT_ALLOW\
roles:\
- C\
- D\
- E\
condition:\
match:\
expr: V.conditionB\
\
- actions:\
- "update"\
effect: EFFECT_ALLOW\
roles:\
- F\
- G\
condition:\
match:\
none:\
of:\
- expr: V.conditionA\
- expr: V.conditionB\
```\
\
This works, but it's not that elegant and there's likely some performance impact as the condition variables may be evaluated ahead of time even if there's no matching rule based on role. Rules can already have names. It would be nice if I can access the condition by rule name.\
\
So maybe something like this:\
\
Copy code\
\
```\
rules:\
- actions:\
- "update"\
name: ruleA\
effect: EFFECT_ALLOW\
roles:\
- A\
- B\
condition:\
match:\
expr: R.attr.status in ["OPEN", "STARTED"]\
\
- actions:\
- "update"\
name: ruleB\
effect: EFFECT_ALLOW\
roles:\
- C\
- D\
- E\
condition:\
match:\
expr: R.attr.status == "RESOLVED"\
\
- actions:\
- "update"\
effect: EFFECT_ALLOW\
roles:\
- F\
- G\
condition:\
match:\
none:\
of:\
- expr: rule.ruleA.conditionA\
- expr: rule.ruleB.conditionB\
```\
\
Maybe this already exists and I just couldn't find it in the docs. I thought the rule name was more for logging/debugging. So my guess is this is not currently possible.\
\
Is there a better way of handling this that I haven't thought of? Thanks!\
\
\
\
- 2\
- 2\
\
j\
\
Jonathan Janisch\
\
08/20/2024, 10:22 AM\
\
This next question is completely unrelated to question above. We're using scoped policies for multi-tenancy. I'm still not sure the best way to handle "default" policy rules.\
\
Let's imagine we take the approach that most people would likely take:\
\
[default](https://community.cerbos.dev/c/default "") scope -> define default rules\
tenant scope -> define tenant specific rules\
\
Sticking with the JIRA analogy from the previous ticket. We might have a resource "ticket" and define some default rules, e.g. role "USER" can "update" a JIRA ticket if they belong to the project.\
\
**A tenant might not want to inherit the default rules**. But the only way they can do that is to create a tenant scoped resource policy that's exhaustive (e.g. it does EFFECT\_ALLOW or EFFECT\_DENY on all possible scenarios).\
\
It seems it would be more powerful and less dangerous if in combination with lenientScopeSearch, a tenant can optionally define a policy and choose to halt evaluating parent scopes.\
\
Copy code\
\
```\
resourcePolicy:\
version: default\
resource: ticket\
scope: tenantA\
evaluateParentScope: false # defaults to true\
```\
\
Or conditionally:\
\
Copy code\
\
```\
resourcePolicy:\
version: default\
resource: ticket\
scope: tenantA\
evaluateParentScope:\
condition:\
match:\
expr: R.attr.someAttr in P.attr.someAttrs\
```\
\
I haven't really thought it through 100% and I'm not sure if scoped Principal policies matter. Just throwing this out there! 🙂\
\
\
\
- 2\
- 13\
\
p\
\
prathmesh 1\
\
08/27/2024, 10:16 AM\
\
Hey, Can anyone please help me to resolve this error -\
\
Copy code\
\
```\
{"log.level":"info","@timestamp":"2024-08-27T14:12:29.172Z","log.logger":"cerbos.server","message":"maxprocs: Updating GOMAXPROCS=1: using minimum allowed GOMAXPROCS"}\
{"log.level":"info","@timestamp":"2024-08-27T14:12:29.173Z","log.logger":"cerbos.server","message":"Loading configuration from /config/config.yaml"}\
{"log.level":"info","@timestamp":"2024-08-27T14:12:29.173Z","log.logger":"cerbos.server","message":"maxprocs: Resetting GOMAXPROCS to 2"}\
{"log.level":"error","@timestamp":"2024-08-27T14:12:29.173Z","log.logger":"cerbos.server","message":"Failed to load configuration","error":"failed to load config: couldn't decode merged YAML: yaml: line 14: could not find expected ':'"}\
cerbos: error: failed to load config: couldn't decode merged YAML: yaml: line 14: could not find expected ':'\
```\
\
\
\
\
\
- 3\
- 23\
\
a\
\
Arthur Fiorette\
\
08/29/2024, 5:20 PM\
\
Hello! I'm having an issue with our Cerbos deployment.\
Somehow\
\
```\
Access-Control-Allow-Origin\
```\
\
header is being sent twice, which then throws a **CORS** error for any request sent to it.\
\
Copy code\
\
```\
Access to fetch at '<https://zephyr-cerbos-dev.zephyr-cloud.io/api/check/resources>' from origin '<http://localhost:3000>' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, <http://dev.zephyr-cloud.io|dev.zephyr-cloud.io>', but only one is allowed. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.\
```\
\
What's the fastest way to debug and solve this issue?\
\
\
\
\
\
- 2\
- 8\
\
u\
\
秋谷知宏\
\
09/11/2024, 3:21 AM\
\
Hello everyone,\
I'm trying to run Cerbos in a Docker container within a GitHub Actions workflow and test permission checks against the Cerbos server. However, I'm encountering an issue where the Cerbos server isn't loading the policy files correctly.\
Does anyone know what could be causing Cerbos to not recognize the policy file, or if there's something wrong with how I'm mounting or formatting the policy?\
\
• Goal\
Start Cerbos in a Docker container in GitHub Actions and test permission checks by mounting policy files.\
\
• Issue\
The policy file isn't being loaded, and the Cerbos server logs show:\
\
```\
Found 0 executable policies\
```\
\
.\
\
• Possible Cause:\
It seems that the policy file isn't being recognized by the Cerbos server, even though it's being mounted to the\
\
```\
/policies\
```\
\
directory.\
\
What I've Confirmed:\
• The policy file exists and is correctly mounted to\
\
```\
/policies\
```\
\
(confirmed by\
\
```\
ls -la\
```\
\
in GitHub Actions).\
• Cerbos logs show\
\
```\
Found 0 executable policies\
```\
\
, meaning the file isn't being read properly.\
• File permissions seem correct.\
• Similarly, when launched locally, it becomes\`Found 1 executable policies\`\
・GitHub Actions Workflow (Simplified):\
\
Copy code\
\
```\
name: ci-server\
on:\
workflow_call:\
env:\
GO_VERSION: "1.20"\
jobs:\
test:\
runs-on: ubuntu-latest\
services:\
cerbos:\
image: <http://ghcr.io/cerbos/cerbos:latest|ghcr.io/cerbos/cerbos:latest>\
ports:\
- 3592:3592\
- 3593:3593\
volumes:\
- ${{ github.workspace }}/policies:/policies\
steps:\
- uses: actions/checkout@v3\
- uses: actions/setup-go@v4\
with:\
go-version: ${{ env.GO_VERSION }}\
cache-dependency-path: server/go.sum\
- name: Check policies directory\
run: ls -la ${{ github.workspace }}/policies\
- name: Check Cerbos logs\
run: docker logs $(docker ps -q --filter "name=cerbos")\
- name: Inspect Cerbos container mounts\
run: docker inspect $(docker ps -q --filter "name=cerbos") --format '{{json .Mounts}}'\
```\
\
・github workflows result\
\
Copy code\
\
```\
Run ls -la /home/runner/work/hoge/foo/policies\
drwxr-xr-x 2 runner docker 4096 Sep 11 06:36 .\
drwxr-xr-x 8 runner docker 4096 Sep 11 06:36 ..\
-rw-r--r-- 1 runner docker 262 Sep 11 06:36 hoge.yaml\
\
Run docker logs $(docker ps -q --filter "name=cerbos")\
{"log.level":"info","@timestamp":"2024-09-11T06:36:04.619Z","log.logger":"cerbos.server","message":"maxprocs: Leaving GOMAXPROCS=2: CPU quota undefined"}\
{"log.level":"info","@timestamp":"2024-09-11T06:36:04.619Z","log.logger":"cerbos.server","message":"Loading configuration from __default__"}\
{"log.level":"warn","@timestamp":"2024-09-11T06:36:04.619Z","log.logger":"cerbos.otel","message":"Disabling OTLP traces because neither OTEL_EXPORTER_OTLP_ENDPOINT nor OTEL_EXPORTER_OTLP_TRACES_ENDPOINT is defined"}\
{"log.level":"info","@timestamp":"2024-09-11T06:36:04.619Z","log.logger":"cerbos.disk.store","message":"Initializing disk store from /policies"}\
{"log.level":"info","@timestamp":"2024-09-11T06:36:04.619Z","log.logger":"cerbos.index","message":"Found 0 executable policies"}\
{"log.level":"info","@timestamp":"2024-09-11T06:36:04.620Z","log.logger":"cerbos.telemetry","message":"Anonymous telemetry enabled. Disable via the config file or by setting the CERBOS_NO_TELEMETRY=1 environment variable"}\
{"log.level":"info","@timestamp":"2024-09-11T06:36:04.620Z","log.logger":"cerbos.grpc","message":"Starting gRPC server at :3593"}\
{"log.level":"info","@timestamp":"2024-09-11T06:36:04.620Z","log.logger":"cerbos.dir.watch","message":"Watching directory for changes","dir":"/policies"}\
{"log.level":"info","@timestamp":"2024-09-11T06:36:04.622Z","log.logger":"cerbos.http","message":"Starting HTTP server at :3592"}\
\
Run docker inspect $(docker ps -q --filter "name=cerbos") --format '{{json .Mounts}}'\
[{"Type":"volume","Name":"243de0b02256460be661e5ec2f0e7e658e9eebd431696af9cfaff55de41998a9","Source":"/var/lib/docker/volumes/243de0b02256460be661e5ec2f0e7e658e9eebd431696af9cfaff55de41998a9/_data","Destination":"/.cache","Driver":"local","Mode":"","RW":true,"Propagation":""},{"Type":"volume","Name":"9327449f5a13ff122f40ccda67471921626d50e360ae8a0810c8957cd604824b","Source":"/var/lib/docker/volumes/9327449f5a13ff122f40ccda67471921626d50e360ae8a0810c8957cd604824b/_data","Destination":"/tmp","Driver":"local","Mode":"","RW":true,"Propagation":""},{"Type":"bind","Source":"/home/runner/work/reearth-dashboard/reearth-dashboard/policies","Destination":"/policies","Mode":"","RW":true,"Propagation":"rprivate"}]\
```\
\
・hoge.yaml\
\
Copy code\
\
```\
apiVersion: api.cerbos.dev/v1\
resourcePolicy:\
version: "default"\
resource: "hoge:foo"\
rules:\
- actions: ["read"]\
effect: EFFECT_ALLOW\
roles:\
- role1\
- actions: ["edit"]\
effect: EFFECT_ALLOW\
roles:\
- role3\
```\
\
\
\
- 2\
- 2\
\
j\
\
Jonah Eisen\
\
09/12/2024, 1:32 PM\
\
I'm running cerbos in Kubernetes, is there a recommended CPU and memory limit to give it?\
\
\
\
- 2\
- 9\
\
p\
\
Pete Bidstrup\
\
09/12/2024, 6:46 PM\
\
Hi Team\
Is the WASM PDP compatible with Cerbos Hub?\
If so, do you have any docs or guides available on production ready configurations, ideally covering FaaS models\
Thanks\
\
\
\
- 2\
- 1\
\
d\
\
Danylo Vivchar\
\
09/13/2024, 7:27 AM\
\
Hey folks,\
with latest Cerbos image I'm getting\
\
```\
SQL logic error: no such table: policy\
```\
\
, it should never happen when in-memory sqlite is used, right?\
\
```\
conf.yaml\
```\
\
Copy code\
\
```\
storage:\
driver: "sqlite3"\
sqlite3:\
dsn: ":memory:"\
```\
\
I'm using testcontainers for some integration tests, here is log from container\
\
Copy code\
\
```\
2024-09-13 13:05:30 {"log.level":"error","@timestamp":"2024-09-13T11:05:30.045Z","log.logger":"cerbos","message":"Failed to add/update policies","protocol":"grpc","grpc.component":"server","grpc.service":"cerbos.svc.v1.CerbosAdminService","grpc.method":"AddOrUpdatePolicy","grpc.method_type":"unary","cerbos":{"call_id":"01J7NGYF3GNHQ5FYNVFRA6NY55"},"peer.address":"192.168.65.1:28747","peer.address":"192.168.65.1:28747","error":"failed to upsert cerbos.resource.RECORD.vdefault: failed to insert policy cerbos.resource.RECORD.vdefault: SQL logic error: no such table: policy (1)"}\
```\
\
from changelog did not see any conf breaking changes\
\
did I miss something?\
\
\
\
- 2\
- 20\
\
a\
\
Anne-Leslie Dean\
\
09/17/2024, 1:56 PM\
\
I have deployed CerbosPDP to a Kubernetes environment and added an Ingress to enforce tls. When interacting via https, the Swagger api explorer is using\
\
```\
http\
```\
\
for the "API Server" is there a way to configure the URL for the API Server (to use\
\
```\
https\
```\
\
?\
\
\
\
\
\
- 2\
- 1\
\
d\
\
David Nilsdotter\
\
09/18/2024, 2:51 AM\
\
Hi team.\
\
I have a basic question regarding authenticating aux data (JWT token). I have read this page: [https://docs.cerbos.dev/cerbos/latest/configuration/index.html](https://docs.cerbos.dev/cerbos/latest/configuration/index.html "") & [https://docs.cerbos.dev/cerbos/latest/configuration/auxdata.html#\_jwt](https://docs.cerbos.dev/cerbos/latest/configuration/auxdata.html#_jwt "")\
I'm trying to implement using a local data key set, but I have a hard time to understand what is the actual intended input here. Based on the key-set information, it seems that it want the _```_\
_Base64-encoded key data defined inline._\
_```_ What is the key data? Just the token secret, or the whole JWK? If it is the JWK, should the key also be base64-encoded, when defined in teh JWK?\
I think I have tried all the different setups, but it continously returns\
\
```\
NotOK: gRPC *error* 3 (INVALID_ARGUMENT): invalid auxData\
```\
\
_We are signing using the sign function from_\
\
```\
jsonwebtoken\
```\
\
like the following:\
\
Copy code\
\
```\
sign(payload, tokenSecret, {}); // Utilizing default settings for jsonwebtoken\
```\
\
This utilizes the default algorithm _```_\
_HS256_\
_```_\
\
Then we define the jwt keySet as following:\
\
Copy code\
\
```\
const buildJWKFromSecret = (tokenSecret: string) => ({\
k: tokenSecret,\
alg: 'HS256',\
});\
\
...\
\
auxData: {\
jwt: {\
keySets: [\
{\
id: 'default',\
local: {\
data: Buffer.from(JSON.stringify(buildJWKFromSecret(tokenSecret)), 'utf-8').toString('base64'),\
},\
},\
],\
},\
},\
```\
\
Here I have tried most configurations:\
\
Copy code\
\
```\
const buildJWKFromSecret = (tokenSecret: string) => ({\
k: Buffer.from(tokenSecret, 'utf-8').toString('base64'),\
alg: 'HS256',\
});\
```\
\
Or just the secret\
\
Copy code\
\
```\
local: {\
data: Buffer.from(tokenSecret, 'utf-8')).toString('base64'),\
},\
```\
\
But all configurations result in\
\
```\
NotOK: gRPC *error* 3 (INVALID_ARGUMENT): invalid auxData\
```\
\
What am I missing here? If I turn the validation off, the aux data is accessible, and my checks pass, so the JWT token is correctly added to the policy requests. It seems that it is the validation that fails.\
\
\
\
- 2\
- 3\
\
t\
\
test-cerbos-nestjs\
\
09/19/2024, 3:33 AM\
\
Hi team!\
I am using '@cerbos/embedded' in react app.\
Currently I have difficulties to check the resource and hence couldn't check if user is allowed to perform certain action. The console didn't display any output.\
Can anyone help with this?\
\
Copy code\
\
```\
import { useCerbos } from '@cerbos/react';\
\
const cerbos = useCerbos();\
const check = await cerbos.checkResource({\
resource: {\
kind: 'test',\
id: testID ?? '',\
},\
actions: ['view'],\
});\
console.log('check',JSON.stringify(check))\
const isAuthorized = check.isAllowed('view');\
```\
\
\
\
h\
\
\
\
- 4\
- 42\
\
t\
\
Tom\
\
09/20/2024, 3:04 PM\
\
Hey folks! We're looking into Cerbos Hub and loving the decentralised nature of authz. We have an extensive set of Cloudflare Workers and would love to deploy the PDP there but I note that it seems unsupported at the moment. Looking at the history, it was on the TODO in April.\
Has this moved any further?\
\
The primary issue is that Cloudflare Workers does not support [WebAssembly.instantiateStreaming](https://developer.mozilla.org/en-US/docs/WebAssembly/JavaScript_interface/instantiateStreaming_static "") or\
\
```\
fetch\
```\
\
in the global scope and the\
\
```\
@cerbos/embeded\
```\
\
SDK requires this.\
I have got it working by bundling the wasm in the app and making a small (breaking) patch to the SDK but it would be nice to have a slicker deployment strategy.\
\
I'm happy to help\
\
\
\
- 2\
- 4\
\
w\
\
Will Laine\
\
09/23/2024, 2:25 PM\
\
Hi, I'm trying to deploy Cerbos as a sidecar in my Kubernetes cluster (AKS). I'm using the .NET SDK to build the Cerbos client with\
\
```\
builder.Services.AddSingleton<ICerbosClient>(sp => CerbosClientBuilder.ForTarget("unix:/sock/cerbos.sock").WithPlaintext().Build());\
```\
\
but I'm getting the following error:\
\
Copy code\
\
```\
System.InvalidOperationException: No address resolver configured for the scheme 'unix'.\
at Grpc.Net.Client.GrpcChannel.GetResolverFactory(GrpcChannelOptions options)\
at Grpc.Net.Client.GrpcChannel..ctor(Uri address, GrpcChannelOptions channelOptions)\
at Grpc.Net.Client.GrpcChannel.ForAddress(Uri address, GrpcChannelOptions channelOptions)\
at Grpc.Net.Client.GrpcChannel.ForAddress(String address, GrpcChannelOptions channelOptions)\
at Cerbos.Sdk.Builder.CerbosClientBuilder.Build()\
```\
\
I don't have any experience working with local unix sockets so I'm sure I'm missing something here. Does my target need to be an http localhost port?\
\
My configmap has the following\
\
Copy code\
\
```\
data:\
".cerbos.yaml": |-\
server:\
# Configure Cerbos to listen on a Unix domain socket.\
httpListenAddr: "unix:/sock/cerbos.sock"\
```\
\
- 1\
- 3\
\
d\
\
David Nilsdotter\
\
09/24/2024, 7:26 AM\
\
Hi.\
I'm running Cerbos in a Kubernetes (more specifically an AWS EKS) cluster, and I need to expose the service, both the http and the grpc interface. I am successful exposing the http-interface, but I encouter difficulty exposing the grpc-interface. Do you have an example of doing this utilizing an AWS ALB? Or do you recommend going down the Ngninx-route? As we manage certificates and dns-handling using AWS Route53, Nginx would complicate things a bit.\
\
\
\
- 2\
- 5\
\
s\
\
Stefan de Kooter\
\
09/26/2024, 6:02 PM\
\
hi!\
I'm looking for some help in policy building:\
Can variables be assigned conditionally? Like derivedRoles, which can have a whole list of (nested) conditions before they get set. Does the same work inside variables as well?\
My use case is that I my Principle.roles -list contains just a set of guids. One of the guids entails that the user is from a specific 'tenant'. This tenant variable can be 1:1 compared with the tenant-name in the Resource. So ideally I'd like to rewrite the guid to a tenant-name very early in the cerbos processing. So that the actual policies can remain simple.\
Any hints?\
This is what I use at the moment:\
\
Copy code\
\
```\
# Derive roles from AzureAD Group GUID\
- name: device_mgmt_read\
parentRoles:\
- default\
condition:\
match:\
any:\
of:\
# all tenants allowed for this guid\
- expr: ("9a0d9319b51f1ef4" in P.roles)\
# If tenantGUID is used, only allow role derivation when Resource is from the same tenant\
- all:\
of:\
- expr: R.attr.Tenant == "TENANT1"\
- expr: ("e25123bf9ca4" in P.roles)\
```\
\
\
\
s\
\
- 3\
- 11\
\
c\
\
Cosmin Marginean\
\
10/02/2024, 7:18 AM\
\
Hi!\
We're looking into integrating the Cerbos REST API and we're using the API spec published here: [https://docs.cerbos.dev/cerbos/latest/api/\_attachments/cerbos-api](https://docs.cerbos.dev/cerbos/latest/api/_attachments/cerbos-api "")\
\
We were wondering if Cerbos publishes versioned specs for this API, as we want to make sure we match the service version against the API spec we're using.\
\
\
\
- 2\
- 2\
\
m\
\
Matthew Gifford\
\
10/03/2024, 9:32 AM\
\
Hi - I'm wondering if it's possible to assign roles with Cerbos. Our roles are very relational, so there's no such thing as a user just being an 'admin' or a 'user'. In our multi-tenant infrastructure, we have client organizations that have projects, and the organizations can subscribe to our applications per project. The organizations can assign their users different roles per project/application.\
\
So, OrgA may have Project1 with App1 and Project2 with App1, and UserA is an admin of Project1/App1, but a viewer of Project2 App1.\
\
\
\
- 2\
- 4\
\
k\
\
Kshitij Gupta\
\
10/03/2024, 10:28 AM\
\
Hi All,\
\
For certain cases, like getting the list of resources, we are planning to use the outputs where once the access to reading a list of resources is allowed for a user, we plan to output a key called "constraint" which will have either a CEL or a mongo-query like expression which our controller will use as a filter expression while querying the list of resources from the database. I understand that the planResources have been provided by Cerbos to do this, but at the moment we find implementing our custom constraint in the "output" much easier given the limitations of converting the planResources output to an ORM query etc. One example is as follows:\
\
Copy code\
\
```\
- actions:\
- READ_ALL\
effect: EFFECT_ALLOW\
roles:\
- USER\
output:\
when:\
ruleActivated: |-\
{\
"constraint": {\
"ownerId": {\
"$eq": P.id\
}\
}\
}\
```\
\
However, as per the docs ( [https://docs.cerbos.dev/cerbos/latest/policies/outputs](https://docs.cerbos.dev/cerbos/latest/policies/outputs "")), excessive use of outputs is not advised. **Wanted to know if there is anything more concrete available on the excessive usage of outputs - whether the size of the output or the number of rules having output is the limiting factor here.**\
\
\
\
- 2\
- 2\
\
w\
\
Will Laine\
\
10/03/2024, 6:01 PM\
\
Hi, is there a recommended way to enforce **all** roles are present, instead of it being a conditional OR?\
\
e.g.\
\
Copy code\
\
```\
roles:\
- USER\
- MANAGER\
```\
\
Make it so that the principal must have roles "USER" AND "MANAGER" instead of "USER" OR "MANAGER"\
\
Thanks\
\
\
\
- 2\
- 1\
\
j\
\
Joseph Akayesi\
\
10/12/2024, 9:17 AM\
\
Hi; I have a policy document that evaluates properly in the Cerbos playground but unable to work in Go code.\
\
Evaluating the "update" action works for when\
\
```\
R.attr.user_id == P.id\
```\
\
however it does not evaluate when\
\
```\
R.attr.role == "supervisor"\
```\
\
In the Cerbos playground; this works properly but in Go code; it does not evaluate properly\
\
Copy code\
\
```\
# yaml-language-server: $schema=<https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json>\
# docs: <https://docs.cerbos.dev/cerbos/latest/policies/resource_policies>\
\
apiVersion: api.cerbos.dev/v1\
resourcePolicy:\
resource: order\
version: default\
rules:\
- actions:\
- update\
effect: EFFECT_ALLOW\
roles:\
- user\
- admin\
- supervisor\
condition:\
match:\
any:\
of:\
- expr: request.resource.attr.user_id == request.principal.id\
- expr: request.principal.attr.role == "supervisor"\
```\
\
\
\
\
\
- 3\
- 10\
\
c\
\
Calvin Karundu\
\
10/13/2024, 2:48 PM\
\
Hello 👋 I'm running into this issue while working with cerbos using Rust. My policies are correct and I can make valid http calls using curl which work as expected. However when working with the Rust SDK, I keep getting this\
\
```\
CheckResources call failed error\
```\
\
which looks like it comes from being unable to compose a correct grpc request with the\
\
```\
InvalidContentType error\
```\
\
. Is this a library issue or is there something I'm missing?\
\
\
\
\
\
- 2\
- 11\
\
j\
\
Joe Cantwell\
\
10/14/2024, 11:54 AM\
\
Hey guys,\
I’m trying to nest hierarichal permissions. I thought I could use derived policies and the compiler seems to like it but my unit test suggests the permissions aren’t inherited. (I’m assigning a single role in my test principle with the expectation that the derived role is inherited) So, Long question short, can a parent role also be a derived role?\
\
Copy code\
\
```\
apiVersion: "api.cerbos.dev/v1"\
description: |-\
Permissions based roles\
derivedRoles:\
name: line_ip_roles\
definitions:\
- name: viewer\
parentRoles: ["user"]\
condition:\
match:\
all:\
of:\
- expr: ...\
\
- name: reader\
parentRoles: ["viewer"]\
condition:\
match:\
all:\
of:\
- expr: ...\
\
- name: editor\
parentRoles: ["reader"]\
condition:\
match:\
expr: ...\
---\
\
apiVersion: api.cerbos.dev/v1\
resourcePolicy:\
version: "default"\
resource: "line:ip"\
rules:\
- actions:\
- view\
effect: EFFECT_ALLOW\
roles:\
- viewer\
\
- actions:\
- read\
effect: EFFECT_ALLOW\
roles:\
- reader\
\
- actions:\
- edit\
effect: EFFECT_ALLOW\
roles:\
- editor\
```\
\
so if my test principal has the\
\
```\
reader\
```\
\
role, I would have thought he’d also have the\
\
```\
viewer\
```\
\
role but that doesn’t seem to be the case. Is this not supported or am I just doing something daft?\
\
\
\
- 2\
- 6\
\
d\
\
Danylo Vivchar\
\
10/17/2024, 6:00 AM\
\
Hey folks,\
did someone saw something similar?\
\
Copy code\
\
```\
{\
"log.level": "error",\
"@timestamp": "2024-10-17T09:48:26.950Z",\
"log.logger": "cerbos",\
"message": "Policy check failed",\
"protocol": "grpc",\
"grpc.component": "server",\
"grpc.service": "cerbos.svc.v1.CerbosService",\
"grpc.method": "CheckResources",\
"grpc.method_type": "unary",\
"cerbos": {\
"call_id": "01JACY1TE1G69R5YMFC2NFKTSG"\
},\
"grpc.request.meta": {\
"request_id": "aa8ce656-6b64-4e14-a8a3-36d9703f224a"\
},\
"peer.address": "127.0.0.1:49852",\
"error": "failed to get check for [PRODUCT.default]: failed to get compilation units: sql: Scan error on column index 2, name \"definition\": failed to unmarshal policy definition: unexpected EOF"\
}\
```\
\
maybe some known issue?\
We have 2 sidecars, very same version, deployed similarly, one is ok, second one is failing with these\
both access same mysql DB.\
Cerbos 0.36.\
(DB was not accessed with anything but Cerbos)\
\
g\
\
- 2\
- 3\
\
s\
\
Stefan de Kooter\
\
10/17/2024, 4:12 PM\
\
Hello Team,\
I'm trying out the Hub Audit log feature. While bulking some requests through Cerbos (~30 request), only 1 Access and 2 Decision Logs (JSON only!) are displayed.\
Besides the buffering- there is no reason for Cerbos to only send interval audit logs to Hub audit- right?\
\
\
\
- 2\
- 4\
\
c\
\
Camille Beguin\
\
10/24/2024, 10:53 AM\
\
Hello,\
\
I have a question related to storage. My use case is that users can be assigned preset policies, or custom policies, in a multi-tenant environment. Preset policies are global and "available" to all tenants, custom policies can be created/updated by users and are only available to some tenants.\
\
To make local dev and testing easier, and also to version control preset policies, ideally we'd be able to use both preset policies as code in git versioned files, and custom policies stored in a database. If it's not possible, we'd need a way to spawn a local Cerbos stack and seed predefined preset policies. Our app is built in Python, so one option would be to store preset policies in a .py file using Cerbos SDK models, and call the Admin API to seed the db. But I like the option of having .yaml policy files and being able to switch easily from disk to postgres storage\
\
Best case scenario we'd be automate creating or updating preset policies from policy files at deployment, and even version them in Cerbos\
\
Has anyone encountered a similar use case and found a workaround?\
\
\
\
- 2\
- 1\
\
b\
\
Brandon Choe\
\
10/28/2024, 10:05 PM\
\
hello! 👋 I'm looking for some help with my Cerbos policies. up until now, our current approach has been working fine. however, I now need to restrict users from sharing workflows 1) if their org limits sharing to Admins (so Members cannot share) and 2) externally if their org limits sharing to internal-only.\
\
for #1, my first thought is to create a new\
\
```\
workflow_sharer\
```\
\
derived role that's separate from\
\
```\
workflow_owner\
```\
\
. while I think this would work, I'm wondering if this is a sign that our current approach is not going to be the best approach for us in the future if we continue to need new granular access controls based on things like org settings.\
\
for #2, it seems like it would make sense that our product simply doesn't allow users of an org with external sharing disabled to set\
\
```\
publicRole\
```\
\
at all. it makes sense to me that this doesn't need to be a policy-level catch. does that make sense?\
\
I've included parts of our resource and role files in the thread.\
\
\
\
- 2\
- 4\
\
d\
\
Danylo Vivchar\
\
10/29/2024, 3:57 PM\
\
Hi!\
Is there a way to auto poll from mysql storage?\
e.g. I've 2 PDPs connected to same MySQL and I want auto-poll changes made by first PDP into second one.\
\
\
\
- 2\
- 1\
\
c\
\
Camille Beguin\
\
11/05/2024, 5:40 AM\
\
Hello, is there a way to create conditions based on an attribute being present or not, and use them in Cerbos resource plan?\
I'd like to have something like\
\
```\
P.attr.business_id ? R.attr.business_id == P.attr.business_id : true\
```\
\
So far the only way I could make it work is by having P.attr.business\_id set to an empty string when it's null, but it's not the best\
\
\
\
- 2\
- 2\
\
w\
\
Will Laine\
\
11/07/2024, 1:19 PM\
\
Is there a recommendation on how to go about multi-tenancy on the same authorizer instance? For example, I have multiple applications making checks by proxying a centralized API (that connects to a Cerbos instance). I was hoping I could use "scope" for this, but that only seems to work when there are multiple policies with the same name. I'm afraid i'll have to prefix all of my resource policies with the instance name .e.g\
\
```\
application1_documents\
```\
\
and\
\
```\
application2_documents\
```\
\
\
\
- 2\
- 1\
\
m\
\
Matheus Cabral\
\
11/07/2024, 2:03 PM\
\
Hello!\
\
Is it possible to do a GetPolicy with Go SDK for a scoped policy?\
\
\
\
- 2\
- 1\
\
m\
\
Mitch\
\
11/08/2024, 6:08 PM\
\
Hello! Can anyone point me to any documentation, blog posts, or any hints to how I can take the Conditional AST from a\
\
```\
PlanResource\
```\
\
call and translate that into an Elastic Search query?\
\
\
\
- 2\
- 2\
\
b\
\
Brandon Choe\
\
11/11/2024, 8:53 PM\
\
hi! is there any way to parameterize tests? couldn't find anything in this slack or in docs\
\
\
\
- 2\
- 1\
\
p\
\
Peter McClonski\
\
11/13/2024, 9:58 AM\
\
Good morning! I’ve just discovered Cerbos and am considering it for upcoming work in my firm. So far, I’m very impressed. My question is largely focused on Principal/User management. Is there a way to tie Cerbos (or Cerbos Hub) into an existing external Users database, ie a Postgres table? We have thousands of users and it would be incredibly valuable to have new users automatically imported into Cerbos Hub with some default set of roles and/or attributes.\
\
\
\
p\
\
h\
\
- 4\
- 6\
\
p\
\
Peter McClonski\
\
11/13/2024, 12:42 PM\
\
Secondary question: Is it possible to deploy an instance of Cerbos Hub into an airgapped, on-prem environment?\
\
\
\
- 2\
- 1\
\
m\
\
Mitch\
\
11/15/2024, 5:38 PM\
\
Hello. Working on a repository. Is there an equivalent to a ‘.gitignore’ for the CLI?\
\
\
\
- 2\
- 8\
\
m\
\
Mohsen Salahshour Majd\
\
11/21/2024, 8:27 AM\
\
Hello. I'm trying to write my first resource policy. So far, I've attempted to validate this yaml file. However, I get an error. Since this is my first time writing policies and generally using cerbos, I suspect I'm missing something. Help is greatly appreciated.\
\
Copy code\
\
```\
apiVersion: api.cerbos.dev/v1\
resourcePolicy:\
version: "default"\
resource: "route"\
rules:\
- actions:\
- view\
effect: EFFECT_ALLOW\
roles:\
- customer\
condition:\
match:\
expr: request.resource.attr.type in ["INDEX", "SHOP_SEARCH"]\
\
rules:\
- actions:\
- view\
effect: EFFECT_ALLOW\
roles:\
- staff\
condition:\
match:\
expr: request.resource.attr.type in ["DASHBOARD"]\
```\
\
Here's the error I'm getting:\
\
Copy code\
\
```\
2024-11-21T13:10:26.096Z ERROR cerbos.index Index build failed {"load_failures": [{"file":"route.yaml","error":"duplicate field definition: previous definition at [5:3]","error_details":{"kind":1,"position":{"line":15,"column":3,"path":"$.resourcePolicy.rules"},"message":"duplicate field definition: previous definition at [5:3]","context":" 12 | match:\n 13 | expr: request.resource.attr.type in [\"INDEX\", \"SHOP_SEARCH\"]\n 14 | \n> 15 | rules:\n ^\n 16 | - actions:\n 17 | - view\n 18 | effect: EFFECT_ALLOW\n 19 | "}}]}\
2024-11-21T13:10:26.097Z ERROR cerbos.server Failed to start server {"error": "failed to create store: failed to build index: missing imports=0, missing scopes=0, duplicate definitions=0, load failures=1"}\
```\
\
\
\
- 2\
- 3\
\
p\
\
Peter McClonski\
\
11/25/2024, 1:19 PM\
\
Does Cerbos recommend or integrate especially well with any particular source of truth on users and their accesses? I know part of the strength of Cerbos is the flexibility to integrate with pretty much any source of truth, but I'm curious if there are any recommendations out there.\
\
\
\
- 2\
- 1\
\
p\
\
Peter McClonski\
\
11/26/2024, 1:16 AM\
\
Also, given the Cerbos PDP helm chart, is there a way to specify a postgres connection string referencing a secret rather than just putting the creds directly in plain text?\
\
\
\
- 2\
- 2\
\
d\
\
Danylo Vivchar\
\
11/26/2024, 4:03 AM\
\
Hey folks,\
does anyone have similar issue [https://cerboscommunity.slack.com/archives/C02A364JYMQ/p1685707043643419](https://cerboscommunity.slack.com/archives/C02A364JYMQ/p1685707043643419 ""),\
where Cerbos is running in k8s with no resource limits and periodically it shuts down with\
\
```\
Shutting down\
```\
\
message?\
(it uses mysql store, no errors seen in logs)\
\
\
\
\
\
- 3\
- 7\
\
m\
\
Maarten Dewaele\
\
12/12/2024, 2:11 AM\
\
Hi all,\
\
given the recommendation about logging\
\
```\
cerbosCallId\
```\
\
in the application logs. How would I access this by using the Java SDK\
\
```\
check\
```\
\
method. It seems it does only return the actual results, not any other response data. Any suggestions on this topic?\
\
> Cerbos API responses include a\
>\
> ```\
> cerbosCallId\
> ```\
>\
> field that contains the unique identifier under which the request was logged to the audit log (if enabled) and the Cerbos activity log. It is recommended that applications log this ID as part of their activity logs too so that those log entries can be joined together with Cerbos logs during log analysis to build a complete picture of the authorization decisions.\
\
Copy code\
\
```\
public CheckResult check(Principal principal, Resource resource, String... actions) {\
Request.AuxData ad =\
this.auxData.map(AuxData::toAuxData).orElseGet(Request.AuxData::getDefaultInstance);\
Request.CheckResourcesRequest request =\
Request.CheckResourcesRequest.newBuilder()\
.setRequestId(RequestId.generate())\
.setPrincipal(principal.toPrincipal())\
.setAuxData(ad)\
.addResources(\
Request.CheckResourcesRequest.ResourceEntry.newBuilder()\
.setResource(resource.toResource())\
.addAllActions(Arrays.asList(actions))\
.build())\
.build();\
\
try {\
Response.CheckResourcesResponse response = withClient().checkResources(request);\
if (response.getResultsCount() == 1) {\
return new CheckResult(response.getResults(0));\
}\
return new CheckResult(null);\
} catch (StatusRuntimeException sre) {\
throw new CerbosException(sre.getStatus(), sre.getCause());\
}\
}\
```\
\
\
\
- 2\
- 3\
\
j\
\
Jonah Eisen\
\
12/16/2024, 3:20 PM\
\
Is there a way to know which action produced which output? If I submit a request with multiple actions I'd like to be able to map the outputs to the actions.\
\
\
\
\
\
- 3\
- 9\
\
t\
\
Thanh Phap Dinh\
\
12/21/2024, 1:10 AM\
\
Hi all,\
If we use just one file to setup policies for multiple resources like following setup, does it work?\
\# file common\_resource.yaml\
apiVersion: [api.cerbos.dev/v1](http://api.cerbos.dev/v1 "")\
resourcePolicy:\
version: "default"\
resource:\
\- settings\
\- market\
\- document\
rules:\
\- actions: \['\*'\]\
effect: EFFECT\_ALLOW\
roles:\
\- admin\
\
\
\
- 2\
- 1\
\
\
\
Jan Kühnlein\
\
12/30/2024, 3:02 PM\
\
I just started to try the go cerbos client ( [https://github.com/cerbos/cerbos-sdk-go](https://github.com/cerbos/cerbos-sdk-go "")) and noticed that I often get timeouts in my tests. I think it’s because LaunchCerbosServer() waits for the docker image and the health check but doesn’t try to connect to the server which leads to flaky tests on my machine (macos + colima) because the grpc connection cannot be established\
As a workaround I use this:\
\
Copy code\
\
```\
func waitForCerbos(t *testing.T, c *cerbos.GRPCClient) {\
assert.Eventually(t, func() bool {\
ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)\
defer cancel()\
_, err := c.ServerInfo(ctx)\
return err == nil\
}, 10*time.Second, 100*time.Millisecond)\
}\
```\
\
The test server is started with:\
\
Copy code\
\
```\
s, err := testutil.LaunchCerbosServer(ctx, testutil.LaunchConf{\
PolicyDir: policyPath,\
})\
```\
\
Any ideas or maybe I’m missing something?\
\
\
\
- 2\
- 3\
\
t\
\
Thanh Phap Dinh\
\
01/03/2025, 2:10 AM\
\
I am trying to use cerbos-sqlalchemy v0.3.2\
\
My cerbos policy like this:\
\# derived\_roles\_common.yaml\
apiVersion: " [api.cerbos.dev/v1](http://api.cerbos.dev/v1 "")"\
derivedRoles:\
name: common\_roles\
\
definitions:\
\- name: coordinator\_same\_destination\
parentRoles: \[ "coordinator" \]\
condition:\
match:\
expr: request.resource.attr.destination in request.principal.attr.destinations\
\
\# booking\_resource.yaml\
apiVersion: [api.cerbos.dev/v1](http://api.cerbos.dev/v1 "")\
resourcePolicy:\
version: "default"\
importDerivedRoles:\
\- common\_roles\
resource: "booking"\
rules:\
\- actions:\
\- view\
effect: EFFECT\_ALLOW\
derivedRoles:\
\- coordinator\_same\_destination\
\
and my models like this:\
\# models.py\
class ModelItinerary(Base, CommonMixin):\
_tablename_ = "itinerary"\
id = Column(Integer, primary\_key=True, index=True)\
destination\_id = Column(Integer, ForeignKey("destination.id"), nullable=True)\
destination = relationship("ModelDestination", back\_populates="itineraries")\
\
What I want is to get from the plan resources a filter\
\
```\
expression\
```\
\
that can be use to apply to sqlalchemy query:\
\
```\
db.query(ModelItinerary).filter(expression)\
```\
\
which will out put correct list of itineraries for coordinator role and when I change the policies the expression will correctly reflect the policies.\
\
\
\
- 2\
- 2\
\
t\
\
Thanh Phap Dinh\
\
01/03/2025, 5:28 AM\
\
Another question: How can I get all permissions of a principal over a resource programmatically in cerbos-sdk like this\
def what\_permissions\_has(principal:Principal, resource\_name:str)->list\[str\]:\
...\
what\_permissions\_has(principalA, "book") # \["borrow", "buy"\]\
It should read from policies and give answer\
\
\
\
- 2\
- 3\
\
c\
\
Camille Beguin\
\
01/06/2025, 9:19 AM\
\
Hello, I am facing an issue with Cerbos SDK and misaligned grpc versions. Related thread:\
[https://github.com/grpc/grpc/issues/22088](https://github.com/grpc/grpc/issues/22088 "")\
\
I checked and Cerbos latest version has a dependency on grpc 1.68.0, while Cerbos Python SDK latest tag (0.11.1) depends on grpc 1.67. Though main branch of the sdk is using grpc 1.68. Are you planning to release a new tag anytime soon?\
\
Thanks,\
\
\
\
- 2\
- 3\
\
j\
\
Jacob R\
\
01/15/2025, 1:45 PM\
\
Hi there, I have what's hopefully a quick confirmation about Cerbos PDP and its CLI - Is the\
\
```\
cerbos compile\
```\
\
command only for running the test suite against the policy repo? The name makes me think it will output some sort of compiled artifact that the PDP would use, but I don't see anything - is the expectation for a CI setup with Cerbos PDP that you just distribute out all the policy yaml files as is to your PDP instances and trigger a store reload via the admin API?\
\
\
\
- 2\
- 2\
\
m\
\
Marek\
\
01/31/2025, 9:25 AM\
\
Quick question - do you offer some discount / longer trial for young startups? I am happy to discuss on DM\
\
p\
\
Peter McClonski\
\
02/01/2025, 12:51 PM\
\
I have what might be a silly question. I have a bunch of things beyond AuthZ which would make sense to externalize to a policy engine. Things like policy-based data validation, where I’d be asking questions like, “Given this set of constraints, is this data element valid?“. It feels to me like the Cerbos PDP, while not specifically meant for this use case, has a policy engine that would serve the use case well. Has anyone ever tried anything like this?\
\
\
\
- 2\
- 5\
\
a\
\
Abdul Rahim Bajwa\
\
02/03/2025, 10:36 AM\
\
Hi I wanted to know can we start with file based policies and store principal policies in the database? Also on that would cerbos scale well if I have multiple principal policies for each user? My objective is to make dynamic policies where admin can assign different permissions to each user in the system\
\
\
\
- 2\
- 2\
\
b\
\
Brandon Choe\
\
02/19/2025, 6:45 PM\
\
hi 👋! are there any plans to restart development on the Cerbos Prisma adapter?\
\
\
\
- 2\
- 29\
\
m\
\
Marek\
\
02/22/2025, 8:56 AM\
\
Hey\
How do you approach testing in CI/CD while using Cerbos? I didn’t find docs on it. I would like to be able to run tests either locally or on pipeline without pushing all the data to the cloud etc (eg to not count MAU from test users etc)\
\
\
\
- 2\
- 6\
\
m\
\
Marek\
\
02/23/2025, 4:40 AM\
\
Hey, how does the trial work? I mean - we are starting from the free plan up to 100 users. We develop and get ready to launch. Then hopefully we get some traction and we activate the trial. We get three months free no matter of number of users and then after three months we start paying based on MAU?\
It is important as first month or two can be not yet bringing any income due to free trials etc so we want to understand it properly\
\
a\
\
- 2\
- 1\
\
m\
\
Marek\
\
02/23/2025, 4:54 AM\
\
Other question, posting separately to make clean, is that if it is possible to sort out permission check if there is more context than just resource and principal to sort out the decision? Like if some assignments are present eg in the third entity?\
\
a\
\
Attilio\
\
02/26/2025, 4:24 AM\
\
Hello everyone,\
I'm new to the channel and I'm experimenting with Cerbos. Specifically, I wanted to use an Envoy sidecar for authorization (authz) with Cerbos. However, I'm having difficulty providing the appropriate payload. Have you ever done this kind of testing? Are there any particular Envoy libraries that could help me use Cerbos within Envoy?\
\
\
\
\
\
- 3\
- 4\
\
r\
\
Razi Ahmad\
\
03/04/2025, 7:20 AM\
\
Hi team, Can we define ReBAC in cerbos, Is there any example available?\
\
a\
\
- 2\
- 1\
\
s\
\
Stefan de Kooter\
\
03/11/2025, 11:09 AM\
\
Hi! what would be the syntax to concatenate a Variable into an output json?\
\
This is NOT OK, what should it be?\
output:\
when:\
ruleActivated: \|-\
{"devicepam\_response\_attributes": {"User-Message": "Username exceeds ~~V.nxos\_username\_max\_length~~ characters, this is not supported on NX-OS"}}\
\
\
\
\
\
s\
\
- 4\
- 5\
\
s\
\
sdktr\
\
03/13/2025, 12:59 PM\
\
Hi authZ-crew,\
Do you have any best practices/tips for scenarios where in the App, a user is able to generate it’s own API tokens with authorizations that can only be a subset of their own rights.\
\
1) when creating the api token with a certain scope, we can ask cerbos whether what they’re trying to generate is ok. Then when the token is used, we can blindly use the token + its scope as Principle\
\
And/or\
\
2) we let the user create any api token they like with whatever scope they wish.\
Once the token is used, we send both the token-scope (untrusted) and the backing user in the principle. But then we should do some form of double authz in cerbos on both the real user and the token attributes? How would that look in your opinion?\
\
Any thoughts?\
\
\
\
- 2\
- 3\
\
d\
\
Desire Kadjo\
\
03/18/2025, 4:24 AM\
\
Hello, I am trying to run the @cerbos/embedded package in my react-native app with Expo and I'm getting the following error when running it\
\
```\
LoadError: Failed to load embedded policy decision point bundle: Property 'WebAssembly' doesn't exist.\
```\
\
Any idea why this is happening? Thanks\
\
\
\
- 2\
- 2\
\
s\
\
Stefan de Kooter\
\
03/18/2025, 7:31 AM\
\
Wildcard match on actions?\
Hi team,\
We make extensive use of actions ending in wildcard (\*). I now found out that if an action is offered ending in a column, it doesn't match these. Is this by design or should I use another wildcard for this?\
\
example:\
\
action in policy:\
\
```\
device_command_show*\
```\
\
offered action:\
\
```\
device_command_show_flash:\
```\
\
NO MATCH\
\
offered action:\
\
```\
device_command_show_flash\
```\
\
MATCH\
\
\
\
- 2\
- 7\
\
s\
\
Stefan de Kooter\
\
03/21/2025, 9:55 AM\
\
hi, can storing of audit data be conditionally, based on the Principle for example? My use case is a cluttered Auditing log with monitoring requests that we're sending to the application.\
\
\
\
- 2\
- 1\
\
m\
\
Mitch\
\
03/24/2025, 9:34 AM\
\
Hello, can someone DM me about deleting an account/organization?\
\
✅ 1\
\
m\
\
Mitch\
\
03/24/2025, 3:51 PM\
\
I'm getting a\
\
```\
Generation Failed\
```\
\
error in Cerbos Hub. Can someone help me diagnose what is going on there?\
\
\
\
- 2\
- 7\
\
s\
\
Stefan de Kooter\
\
03/31/2025, 5:43 AM\
\
hi team! Do you have an example of sending the 'scope' in a request, using the .net SDK?\
\
- 1\
- 1\
\
b\
\
Benjamin Rupp\
\
04/01/2025, 11:48 AM\
\
Hi. I have an issue with Role Policies on Cerbos 0.42.0 and need some clarification\
\
\
\
b\
\
- 3\
- 12\
\
s\
\
Siddharth Pansuria\
\
04/01/2025, 3:00 PM\
\
Hi, I am trying to run a schema that I created on cerbos playground, locally on my machine using docker, but I am unable to enable admin API. I am using this command\
\
```\
docker run --rm --name cerbos -d -v $(pwd)/cerbos-quickstart:/quickstart -p 3592:3592 <http://ghcr.io/cerbos/cerbos:0.42.0|ghcr.io/cerbos/cerbos:0.42.0> server --config=/quickstart/.cerbos.yaml\
```\
\
. But the container starts and stops instantly as if it never started in the first place. I am using docker on windows. The normal quickstart tutorial mentioned [here](https://docs.cerbos.dev/cerbos/latest/quickstart "") is working just fine, but when I try to enable admin api using the yaml file, the docker container crashes almost instantly and I can't even see the logs. Can someone guide me through this?\
\
p\
\
\
\
- 3\
- 9\
\
s\
\
Stefan de Kooter\
\
04/04/2025, 3:30 AM\
\
hi! During development of cerbos policies on my machine, I test using this command before pushing to the policy repo:\
\
Copy code\
\
```\
docker run -it -v .:/policies ghcr.io/cerbos/cerbos:0.40.0 compile /policies\
```\
\
I'm now testing with scopeing and for my policies to work I need the a config option for lientscopesearch.\
\
How can I map a custom config, or just the flag I need, to make my tests pass? Also, how will these flags be passed in Cerbus Hub, to pass the tests there as well?\
\
\
\
- 2\
- 4\
\
s\
\
Stefan de Kooter\
\
04/09/2025, 9:59 AM\
\
Next question: do you have a complete overview of all the variables that we could be using in policy and output definitions? Eighter documentation or runtime based?\
\
I got a question like: can we output the name of the derived\_roles that where in place during policy evaluation, as part of an output in the policy?\
\
\
\
- 2\
- 7\
\
w\
\
William Adjei\
\
04/10/2025, 8:57 AM\
\
Hey guys I need help setting up a role based navigation bar but when I make a request, no matter the role I get\
\
```\
EFFECT_DENY\
```\
\
w\
\
William Adjei\
\
04/10/2025, 8:59 AM\
\
Copy code\
\
```\
derived_roles.yaml:>>\
\
apiVersion: "api.cerbos.dev/v1"\
derivedRoles:\
name: navigation-roles\
definitions:\
- name: admin-role\
parentRoles: ["admin", "ADMIN", "Admin"]\
- name: manager-role\
parentRoles: ["manager", "MANAGER", "Manager"]\
- name: user-role\
parentRoles: ["user", "USER", "User"]\
\
menu_policy.yaml:>>\
\
apiVersion: api.cerbos.dev/v1\
resourcePolicy:\
version: "default"\
importDerivedRoles:\
- navigation-roles\
resource: navigation\
rules:\
# Fallback rule for debugging - allow access to everyone with basic menu\
- actions: ["access"]\
derivedRoles:\
- any-role\
effect: EFFECT_ALLOW\
output:\
expr: '{"allowed_menu_items": ["/dashboard"]}'\
\
# Regular rules\
- actions: ["access"]\
derivedRoles:\
- admin-role\
effect: EFFECT_ALLOW\
output:\
expr: '{"allowed_menu_items": ["/dashboard", "/sales", "/marketing"]}'\
\
- actions: ["access"]\
derivedRoles:\
- manager-role\
effect: EFFECT_ALLOW\
output:\
expr: '{"allowed_menu_items": ["/dashboard", "/sales"]}'\
\
- actions: ["access"]\
derivedRoles:\
- user-role\
effect: EFFECT_ALLOW\
output:\
expr: '{"allowed_menu_items": ["/dashboard"]}'\
```\
\
\
\
\
\
- 3\
- 17\
\
w\
\
William Adjei\
\
04/10/2025, 8:59 AM\
\
Here's a sample of my policy\
\
j\
\
Joe Cantwell\
\
04/15/2025, 9:21 AM\
\
Hey all,\
We're using Cerbos in my company and I just got asked a question that I hadn't thought about before.\
\
> if a user action request matches an ALLOW and a DENY, what is the resolution strategy?\
\
My initial thought was that its unlikely to happen but I guess if a user is added to multiple Roles and the resource policy grants access to one of those roles and explicitly denies access to a second role containing the user then it could be a thing. My assumption is that Cerbos is deny by default and the response will be\
\
```\
DENY\
```\
\
but I haven't tested this yet. Does anyone have any experience of a scenario like this?\
\
\
\
- 2\
- 2\
\
s\
\
Siddharth Pansuria\
\
04/15/2025, 4:10 PM\
\
Hey everyone, I was able to test my policies locally via a docker image and running the SQL script to access the admin API. What would be the next steps if I want to deploy it to our dev environment? How would I be able to give connection of my own database via the config file?\
\
\
\
- 2\
- 3\
\
m\
\
Martin Carlsson\
\
04/18/2025, 5:23 AM\
\
What is the best practice for debugging?\
\
I'm trying to figure out why this specific code returns forbidden.\
\
But I cannot figure out where my problem is, and I don't know where to look.\
\
Copy code\
\
```\
export const runtime = 'nodejs';\
\
import { NextRequest, NextResponse } from 'next/server';\
import { can } from '@/lib/cerbos';\
\
export async function GET(_req: NextRequest, { params }: { params: Promise<{ id: string }> }): Promise<NextResponse> {\
const { id: docId } = await params;\
\
const principal = { id: 'user123', roles: ['reader'] };\
\
try {\
const allowed = await can(principal, 'view', {\
kind: 'document',\
id: docId,\
});\
\
if (!allowed) {\
return NextResponse.json({ error: 'Forbidden' }, { status: 403 });\
}\
\
return NextResponse.json({ id: docId, content: 'This is secret.' });\
} catch (err) {\
console.error('Cerbos unreachable:', err);\
return NextResponse.json({ error: 'Authorization service unavailable' }, { status: 503 });\
}\
}\
```\
\
Copy code\
\
```\
apiVersion: api.cerbos.dev/v1\
resourcePolicy:\
version: default\
resource: document\
rules:\
- actions: ['view']\
roles: ['reader']\
effect: EFFECT_ALLOW\
```\
\
\
\
- 2\
- 7\
\
m\
\
Mitch\
\
04/18/2025, 6:11 PM\
\
Hello all.\
\
I'm running into a weird issue with the embedded library in a nestjs application.\
\
Here is the error I'm getting and I can't figure out for the life of me where to even start:\
\
Copy code\
\
```\
RuntimeError: unreachable\
at rust_panic (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/dab92eda16f19d3643e91b3c4413990f29276af36bc433f0fb42457debbb8a14.wasm:1:108916>)\
at _ZN3std9panicking20rust_panic_with_hook17h4501cceb7dbe383dE (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/dab92eda16f19d3643e91b3c4413990f29276af36bc433f0fb42457debbb8a14.wasm:1:108904>)\
at _ZN3std9panicking19begin_panic_handler28_$u7b$$u7b$closure$u7d$$u7d$17hc2b9d3fc26dda7f9E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/dab92eda16f19d3643e91b3c4413990f29276af36bc433f0fb42457debbb8a14.wasm:1:109126>)\
at _ZN3std3sys9backtrace26__rust_end_short_backtrace17hf6a83a0a2155b9c0E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/dab92eda16f19d3643e91b3c4413990f29276af36bc433f0fb42457debbb8a14.wasm:1:108938>)\
at rust_begin_unwind (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/dab92eda16f19d3643e91b3c4413990f29276af36bc433f0fb42457debbb8a14.wasm:1:88061>)\
at _ZN4core9panicking9panic_fmt17h619600efce2da276E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/dab92eda16f19d3643e91b3c4413990f29276af36bc433f0fb42457debbb8a14.wasm:1:83181>)\
at _ZN4core9panicking5panic17h33e5dee0c2e78184E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/dab92eda16f19d3643e91b3c4413990f29276af36bc433f0fb42457debbb8a14.wasm:1:39439>)\
at __rust_dealloc (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/dab92eda16f19d3643e91b3c4413990f29276af36bc433f0fb42457debbb8a14.wasm:1:28605>)\
at _ZN63_$LT$alloc..alloc..Global$u20$as$u20$core..alloc..Allocator$GT$10deallocate17hdd9\
```\
\
Can someone help me with this?\
\
\
\
- 2\
- 1\
\
m\
\
Martin Carlsson\
\
04/20/2025, 12:29 AM\
\
I'm setting up my local development environment.\
\
Are there any way I can check if I've formatted the policy yml files correctly?\
\
\
\
- 2\
- 9\
\
m\
\
Martin Carlsson\
\
04/21/2025, 1:16 AM\
\
I have a Cerbos setup now that I quite like 👌\
\
My next step is to get the Query Criteria to work.\
\
I couldn't find an explanation on how it works in the documentation.\
\
Could you point me to the correct documentation, an article or a YouTube video that shows how it works?\
\
I'm using Node/React/Next. But I don't use Prisma.\
\
Technically, what I need it just an policy yaml example, and how to call it from the Cerbos JavaScript SDK.\
\
\
\
- 2\
- 15\
\
s\
\
Siddharth Pansuria\
\
04/22/2025, 2:45 PM\
\
Hi, sorry for bringing it up again, but I'm still a little confused if the implementation that we currently have is correct or not. Let me explain my current setup, this is what I use to check things locally:\
\
1\. I run a docker image as mentioned in the quickstart tutorial. Along with this I also run a posgress image, which is necessary to make changes to the policy via the admin API.\
2\. After this I run our Node.js backend where I have stored our policies, and then use the cerbos library to add the stored policies. (I could probably do this via the docker config file, but couldn't do it for some reason, so I resorted to this. I'll also have code that will enable policy updates and changes in the future, so I'm guessing this shouldn't be an issue.)\
3\. I finally run my frontend, where I use the cerbos library to check access to specific resources.\
Now currently, everything seems to run pretty smoothly, but I am not sure about how I should be deploying this to our dev environment, I have some questions regarding that.\
\
1\. Currently I am running a posgress image and creating the required db schema, so I can make changes to the schema via the admin API. Is it possible to use our internal db (SQL Server) for this?\
2\. When we deploy to dev, would we have to run the same cerbos docker image to enable the PDP?\
3\. Is this implementation correct and is it okay to read the policies like this using cerbos library or is adding the directory to the config file more efficient?\
\
\
\
- 2\
- 5\
\
h\
\
Hrishikesh Barman\
\
04/26/2025, 6:57 AM\
\
Hi I was planning to use [https://github.com/porsager/postgres](https://github.com/porsager/postgres "") for my backend application and use cerbos, but it seems like cerbos only supports sqlalchemy and prisma?\
[https://docs.cerbos.dev/cerbos/latest/recipes/orm/sqlalchemy/](https://docs.cerbos.dev/cerbos/latest/recipes/orm/sqlalchemy/ "")\
\
am I missing something here?\
\
h\
\
Hrishikesh Barman\
\
04/26/2025, 6:58 AM\
\
I don't fully understand the requirement of this DB integration, if it exists, why does it exists? Is it trying to do something what postgres RLS does?\
\
h\
\
Hrishikesh Barman\
\
04/26/2025, 6:59 AM\
\
Do I need to marry cerbos and my db like this in the general use of cerbos?\
\
\
\
- 2\
- 7\
\
y\
\
Yusuf Sultan\
\
05/05/2025, 5:53 AM\
\
I know the answer is "it depends" but I still want at least some basic advice here: in a microservices architecture with a gateway, should the gateway use Cerbos to authorize requests, or should microservices use Cerbos to authorize requests?\
\
\
\
- 2\
- 6\
\
y\
\
Yael Margalit\
\
05/08/2025, 6:49 AM\
\
Hi,\
We have this error from Cerbos:\
"\*error\*": "failed to get policies: context deadline exceeded"\
We see in mysql monitoring AbortedClients (attached screenshot)\
Could you assist why does it happen and what can we do?\
Let me know if you need any more information\
Thanks\
Slack Conversation\
\
\
\
- 2\
- 1\
\
y\
\
Yael Margalit\
\
05/08/2025, 6:49 AM\
\
Another question-\
We see that it's using writer instance.\
Can we configure something different so it will use the reader?\
\
\
\
- 2\
- 1\
\
b\
\
Byron Hager\
\
05/09/2025, 3:54 PM\
\
Hello, a while back I POC'd a solution with Cerbos to support users being able to customize their own role definitions including attribute-based conditions (using the Admin API). However, at the time, Cerbos supported a SQL Server driver, which simplified additional infra for our DevOps team. Now we're considering our options (particularly in the short to mid term) aside from setting up a separate Postgres or MySQL instance.\
\
I haven't seen if there are other ways to plug-in a custom driver or if there are plans to support that ability. If there was an option in this vein, then we could consider planning to use SQL Server longer term anyway although it would still be fairly likely to be too much of a maintenance burden for our team.\
\
We have a solution with static role definitions/policies that works using a File Share on Azure Storage (disk driver). Especially at our scale it might be enough to just upload policies and reload the Cerbos instance(s), accepting some propagation delay and limited management functionality. Schemas and policies related to default role definitions will update behind a deployment anyway and we don't expect updates to happen at a huge scale likely for some time.\
\
Are there other options to consider?\
How viable is evolving on a file-based solution? Or are there gotchas that might warrant prioritizing moving to a DB driver sooner?\
\
Further, I understand the Admin API could introduce breaking changes in future updates. I don't see it as a major deterrent from moving off a file-based solution when running our own instance, but not sure how often we should expect to make code changes alongside a version update.\
\
Sorry for the lengthy post, but any feedback would be much appreciated.\
\
\
\
- 2\
- 2\
\
y\
\
Yusuf Sultan\
\
05/11/2025, 1:02 PM\
\
Very very long time ago I looked for a Cerbos feature that convert YAML schemas to TypeScript files so the inputs can be statically checked to have all data needed for Cerbos to be able to make a proper decision per schemas.\
\
I remember then this wasn't implemented, but is this still the case now? It has probably been years since I looked/asked\
\
\
\
- 2\
- 3\
\
y\
\
Yusuf Sultan\
\
05/12/2025, 7:07 AM\
\
I have a design question: what kinds of checks should be done in Cerbos and which checks should be done in app code?\
\
For example let's say a "teacher" can make a back-end request to "grade" "homework". For a teacher to do that the following needs to be met:\
• The user is actually a teacher at all\
• The teacher is grading within office hours (they cannot grade outside of that)\
• The teacher is part of staff of the course under which the homework is\
• The teacher must have downloaded all of homework's files before they're allowed to grade it\
• The homework was not already graded by another teach BUT if it's the same teacher updating the grade WITHIN 30 minutes of prior grading it's fine that can go through\
• ...\
Which of these would be in the request handler function, and which of these would go into Cerbos? Notably a lot of these checks rely on distant data that is potentially not even relevant to the principal/resource\
\
❤️ 1\
\
\
\
- 2\
- 6\
\
a\
\
Andrew Bettke\
\
05/13/2025, 12:55 PM\
\
Hey, new-time user to Cerbos and having some trouble getting some policy definitions in place. Could use some help on where I'm going wrong. I'm going to drop the details of what I'm trying to do and the troubles I'm seeing in the thread\
\
\
\
- 2\
- 4\
\
s\
\
Siddharth Pansuria\
\
05/14/2025, 1:40 PM\
\
Hi, I am trying to implement role policies, and it seems to be denying everything even though I have added an exhaustive list of resources and allowable actions. Am I missing something here?\
\
\
\
- 2\
- 4\
\
m\
\
Maarten Dewaele\
\
05/15/2025, 9:47 AM\
\
Hi,\
\
I just noticed that our application size increases exponentially when including cerbos-sdk-java with Maven.\
\
It seems like all dependencies are having a\
\
```\
runtime\
```\
\
scope which causes them all to be included.\
\
Can this be reviewed to have a smaller footprint or am I doing something wrong?\
\
Currently it adds +/- 60mb to our packaged application, which seems a lot\
\
\
\
- 2\
- 1\
\
v\
\
Vish\
\
05/27/2025, 1:33 AM\
\
Hello, I'm interested in the audit log masking feature. It appears to me that it's only available for the hub backend, is this true? Can I use it with my existing file backend?\
\
\
\
- 2\
- 3\
\
b\
\
Byron Hager\
\
05/28/2025, 1:27 PM\
\
Hi, thought I post here before possibly opening a GH issue. I'm trying to use role policies with the plan resources endpoint (v0.43.0). In short, when a user has multiple roles where one allows an action and another doesn't, I'm seeing\
\
```\
KIND_ALWAYS_DENIED\
```\
\
, even though check resources will allow in practice.\
\
If a user has a Reader and Admin role, for example, I would expect\
\
```\
thing:update\
```\
\
to result in either\
\
```\
KIND_ALWAYS_ALLOWED\
```\
\
(or\
\
```\
KIND_CONDITIONAL\
```\
\
if more conditions are relevant), but it seems like because the Reader role would restrict the user on any update action the result ends up being\
\
```\
KIND_ALWAYS_DENIED\
```\
\
.\
\
Is that expected?\
\
\
\
\
\
- 3\
- 5\
\
y\
\
Yehiel Mizrahi\
\
06/08/2025, 9:44 AM\
\
Hi\
We are experiencing certain problem in one of our deployments with Cerbos. The pod in EKS that runs Cerbos and out service suddenly becomes unhealthy - Cerbos crashes due to OOM error. When I try to analyze Cerbos logs in Cloudwatch I see nothing, alss using Kubectl on the pod to see the memory usage (or to see if there is a memory pressure on the node) gives nothing. How can I understand the reasons for this sudden problem? The\
\
```\
policy\
```\
\
table size in Db is only 5 Mb (we are using AWS managed MySQL 8.0 DB), but\
\
```\
policy_retention\
```\
\
table size is 66 Gb (another issue that I want to address - can we configure this so Cerbos will keep only limited policy changes history or we need to do a scheduled deletion by ourselves?). The policy caching settings are the default ones.\
Thank you!\
\
\
\
y\
\
- 3\
- 5\
\
a\
\
Alexandru Dragomir\
\
06/09/2025, 3:04 PM\
\
Hello! I’m getting some validation errors when trying to add a policy using\
\
```\
cerbos-sdk-go@v0.2.15\
```\
\
and I’m not sure if I’m doing something wrong or is there a bug in the SDK. I’ll add the code and the error bellow:\
\
Copy code\
\
```\
// Code\
rule := cerbos.NewAllowResourceRule("createUser")\
err := rule.Validate()\
if err != nil {\
panic(fmt.Sprintf("failed to create allow resource rule: %v", err))\
}\
```\
\
Copy code\
\
```\
// Error\
"failed to create allow resource rule: compilation error: failed to compile standard constraint \"<http://buf.validate.EnumRules.in|buf.validate.EnumRules.in>\": compilation error: failed to compile expression <http://enum.in|enum.in>: ERROR: <input>:1:19: undeclared reference to 'getField' (in container '')\n | !(this in getField(rules, 'in')) ? 'value must be in list %s'.format([getField(rules, 'in')]) : ''\n | ..................^\nERROR: <input>:1:79: undeclared reference to 'getField' (in container '')\n | !(this in getField(rules, 'in')) ? 'value must be in list %s'.format([getField(rules, 'in')]) : ''\n | ..............................................................................^"\
```\
\
\
\
- 2\
- 1\
\
j\
\
Joe Cantwell\
\
06/12/2025, 4:30 AM\
\
Hi,\
I'm pretty familiar with the standard resource policies but I'm looking at a policy that is essentially duplicated 3 times - each for different (but related) resources. Each policy grants access to the same collection of IDP groups and has a single condition. I _think_ this could be handled with a role policy but the existing unit tests don't like my approach.\
\
Am I missing something obvious? The parentRoles are real groups but my role itself is just a string. Does this also need to be a real role?\
\
Copy code\
\
```\
apiVersion: api.cerbos.dev/v1\
rolePolicy:\
role: "notaRealRole\
parentRoles:\
- group:default/admins\
- group:default/employees\
- group:default/users\
\
rules:\
- resource: "resource.action"\
allowActions: ["*"]\
condition:\
match:\
expr: P.attr.isemployee == true\
\
- resource: resource.task\
allowActions: ["*"]\
condition:\
match:\
expr: P.attr.isemployee == true\
\
- resource: resource.template\
allowActions: ["*"]\
condition:\
match:\
expr: P.attr.isemployee == true\
```\
\
\
\
- 2\
- 1\
\
a\
\
Andrew Bettke\
\
06/16/2025, 3:23 PM\
\
Hi, we use UUIDs as the string for\
\
```\
resourcePolicy.resource\
```\
\
. When we create policies in this manner, we have noticed the underlying identifier that Cerbos then requires when referring to the policy uses underscores instead of hyphens. Is this intended by cerbos? Is there a way to configure it such that it doesn't alter the string used as the resource key?\
\
Example.\
Resource policy with\
\
```\
resource\
```\
\
set to\
\
```\
d3eca871-3ba3-4aec-8ff5-ad5cc7cbb546\
```\
\
Produces an identifier that is\
\
```\
resource.d3eca871_3ba3_4aec_8ff5_ad5cc7cbb546.vdefault\
```\
\
\
\
- 2\
- 5\
\
j\
\
Jon Farmer\
\
06/18/2025, 4:20 AM\
\
Hi, I have run\
composer require cerbos/cerbos-sdk-php which doesn't seem to produce an error. I am trying the example PHP call as follows:\
\
$client = CerbosClientBuilder::newInstance("localhost")\
->withPlaintext(true)\
->build();\
\
But I get\
\
Uncaught Error: Class "CerbosClientBuilder" not found\
\
In the error log?\
\
Where am I going wrong?\
\
\
\
- 2\
- 12\
\
j\
\
Jia Jun Koh\
\
06/23/2025, 11:45 AM\
\
Hello team,\
Can a derived role be parent role of another derived role?\
\
\
\
\
\
- 3\
- 3\
\
a\
\
Ahmad Fathallah\
\
06/26/2025, 4:38 AM\
\
Hello,\
\
I am trying to migrate an existing system to cerbos, the exsiting has already some RBAC like authorisation implemented.\
\
there a super admin that has all permission, the admin can create a roles as they please and CRUD permission per resource.\
\
my question is can we write policies in cerbos, that is build on top the existing system?\
\
so for example in the existing system,\
\
```\
user with role of seller, the seller role can edit listing resource.\
```\
\
let's say the above is already defined in the existing system.\
\
so additional rules might be.\
\
```\
user id must be equal to the listing author\
```\
\
so the full rule will be\
\
```\
user can edit listing (existing system), user id must equal to listing author (cerbos)\
```\
\
\
\
- 2\
- 2\
\
b\
\
Benjamin Rupp\
\
06/26/2025, 11:38 AM\
\
Hello Cerbos Team,\
We are solving a use case with _PlanResources_, where we need Cerbos to return the conditions that are required to access certain data.\
\
\
\
b\
\
- 3\
- 25\
\
s\
\
Seth T\
\
06/27/2025, 6:43 PM\
\
Hello! Is there a good example of how to organize and use scoped policies?\
I’m trying to evaluate and model some existing permissions and it seems like the scopes would be a good fit, but the playground doesn’t seem to generate them and if i just paste in a policy file named like\
\
```\
resource.yaml\
```\
\
and split the scoped policies within by\
\
```\
---\
```\
\
so they are separate yaml files, it borks.\
I don’t see any examples of how i can use multiple policies for the same resource but with differing scopes.\
Any help appreciated.\
\
\
\
- 2\
- 2\
\
s\
\
Seth T\
\
06/27/2025, 6:47 PM\
\
well dang, i guess asking for help was the key. I just discovered the\
\
```\
demo-multitenant-saas\
```\
\
which kind of shows this. At least gets me started.\
\
👍🏼 1\
\
s\
\
Seth T\
\
06/29/2025, 3:04 PM\
\
So now I think I’m getting close to having a permission model i can work with, But i’m confused on principal policies.\
I’m trying to create a principal policy to override only a scoped policy, but it complains that that i’m missing a scoped prinicpal policy for\
\
```\
vdefault\
```\
\
because my intent is to only have a principal policy to override scope “customer”.\
How do i define essentially a no-op vdefault principal policy to satisfy the hierarchy?\
Or maybe I’m not understanding how principal policies work?\
\
\
\
- 2\
- 3\
\
y\
\
Yehiel Mizrahi\
\
06/30/2025, 5:34 AM\
\
Hi\
I have upgraded Cerbos image to 0.43.0 on one of our services (it runs as a sidecar with one of our services), but service uses the save version of cerbos sdk as before the image upgrade. Does it mean that I need to upgrade the cerbos sdk too?\
\
\
\
- 2\
- 2\
\
y\
\
Yehiel Mizrahi\
\
07/06/2025, 11:25 AM\
\
Hi\
After upgrading Cerbos image to 0.43.0 on one of out services all of our tests related to Cerbos authorization checks started failing.\
Upon debugging I have noticed that policy that was returning ALLOW on certain check request is now returning DENY.\
Was there some change in regards to policy structure?\
I also would like to understand how to extract a single policy using\
\
```\
cerbosctl\
```\
\
\- when running:\
\
Copy code\
\
```\
cerbosctl get resource_policy --name=RECORD --server=localhost:3594 --username=<my_user> --password=<my_pass> --plaintext\
```\
\
I get:\
\
Copy code\
\
```\
cerbosctl: error: failed to list: error while listing policies: could not get policy: rpc error: code = ResourceExhausted desc = grpc: received message larger than max (12398930 vs. 4194304)\
```\
\
But policies are not that big - the entire policy table is 5 MB (see the screenshots)\
Is it trying to get all of the policies? Why if I am trying to get only one?\
\
Thank you!\
\
\
\
\
\
\
\
b\
\
\
\
- 4\
- 59\
\
a\
\
Aman Humagain\
\
07/07/2025, 9:33 PM\
\
Hello, I'm implementing cerbos in a multitenant system, and psql as a storage for it. How can I maintain policies in isolation for each tenant? Note: there'd also be set of default policies that applies to all the tenants. Also, can i acheive dynamic role creation and permissions assignment (with conditions too)? Any help or link to any resources would be very helpful. Thank you!\
\
m\
\
Mitch\
\
07/10/2025, 10:49 PM\
\
Can anyone help us out? We're running into a\
\
```\
wasm\
```\
\
error we can't figure out:\
\
Copy code\
\
```\
stack: 'RuntimeError: unreachable\n' +\
' at policy.wasm._RNvCs691rhTbG0Ee_7___rustc10rust_panic (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[419]:0x280e4>)\n' +\
' at policy.wasm._ZN3std9panicking20rust_panic_with_hook17hc276d0501ad5b954E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[418]:0x280d8>)\n' +\
' at policy.wasm._ZN3std9panicking19begin_panic_handler28_$u7b$$u7b$closure$u7d$$u7d$17h23ff416a921468b4E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[422]:0x281b6>)\n' +\
' at policy.wasm._ZN3std3sys9backtrace26__rust_end_short_backtrace17h16ab72765b32282dE (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[421]:0x280fa>)\n' +\
' at policy.wasm._RNvCs691rhTbG0Ee_7___rustc17rust_begin_unwind (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[316]:0x22a69>)\n' +\
' at policy.wasm._ZN4core9panicking9panic_fmt17h41cfed79b2ddbf13E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[268]:0x20b17>)\n' +\
' at policy.wasm._ZN4core9panicking5panic17hcb4f0bfb9f36a348E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[168]:0xad24>)\n' +\
' at policy.wasm._RNvCs691rhTbG0Ee_7___rustc14___rust_dealloc (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[102]:0x6318>)\n' +\
' at policy.wasm._ZN4core3ptr46drop_in_place$LT$alloc..vec..Vec$LT$u8$GT$$GT$17h767aafaf8f7f55e3E (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[11]:0x175a>)\n' +\
' at policy.wasm.deallocate (<https://cdn.cerbos.cloud/pid_-5825791762986962624/lite/bundle/3c9be6dfc25fb7c93231e582e20be3e0e82034172762238f36b297e340264f40.wasm:wasm-function[254]:0x1fbdd)>',\
```\
\
\
\
- 2\
- 1\
\
m\
\
Mitch\
\
07/10/2025, 11:07 PM\
\
Anyone?\
\
b\
\
Billy Bolton\
\
07/11/2025, 2:37 PM\
\
Hey folks,\
Is the action assigned to a resource policy case sensitive against the CheckResource and PlanResource apis?\
\
\
\
- 2\
- 4\
\
b\
\
Billy Bolton\
\
07/17/2025, 10:18 AM\
\
Hi everyone,\
\
I had a question about the [Reload API](https://docs.cerbos.dev/cerbos/latest/api/admin_api.html#store-management "")\
I'm noticing a scenario in my integration tests where a newly added policy does not seem accessible. However, this occurs only when there are many policies being added in sequence (from previously ran tests). It smells like a race condition... Calling reload with wait=true solves the issue, but I think it's because of the wait rather than the reloading itself.\
(Note, we have not set the polling config value, which therefore means the polling is set to 0)\
\
I'm wondering if there is a way to confirm whether such a scenario is indeed a race condition or not. Do we have any load test bench marking, etc?\
\
\
\
- 2\
- 5\
\
s\
\
Stefan de Kooter\
\
07/29/2025, 10:44 AM\
\
hi; we would like to achieve the following:\
\
1\. allow the action starting with 'a\_b\_c\*'\
2) deny the action starting with 'a\_b\*' (there are 100+ options we'd rather not copy over to cerbos)\
3) allow the action starting with 'a\*'\
\
when specifying all three, the DENY from the 'a\_b\*' is causing a deny to the 'more specific' 'a\_b\_c'.\
\
How can we solve this?\
• other wildcard/regex options in the name of the deny action?\
• add an expression to the expression of the policy?\
• other? default behavior flag maybe?\
For all: what syntax should I use?\
\
a\
\
\
\
- 3\
- 4\
\
a\
\
Anne-Leslie Dean\
\
07/29/2025, 6:45 PM\
\
My team just spun up CerbosPDP in AWS in a minor variation of this lambda: [https://github.com/cerbos/cerbos-aws-lambda](https://github.com/cerbos/cerbos-aws-lambda "")\
We are observing what seem like fairly long startup/performance times for the lambda that seem related to the CerbosPDP binary. We are loading a few simple policies from an S3 bucket that derive role(s) from the principal and then resolve access to a single resource (kind) based on those roles. Can anyone comment on similar experiences or what optimization(s) we might further consider.\
\
Copy code\
\
```\
Memory Cold Start Init (ms) Warm Start Duration (ms)\
128 7353 2921\
256 2585 205\
512 1967 88\
```\
\
\
\
- 2\
- 4\
\
j\
\
Joe Cantwell\
\
07/30/2025, 11:35 AM\
\
Hi,\
Apologies if this has been asked before but I'm wondering what the syntax is to handle an attribute that may or may not exist.\
for example, suppose I have an attribute on a resource called\
\
```\
dataClass\
```\
\
and its value can be\
\
```\
public\
```\
\
or\
\
```\
private\
```\
\
. if the attribute is missing from the resource, I should assume its\
\
```\
private\
```\
\
I can do something like the following to match it in a derived role\
\
Copy code\
\
```\
- all:\
of:\
- expr: R.attr.dataClass <= ''\
```\
\
and that works if I specify the\
\
```\
dataClass\
```\
\
attribute on my test resource but set its value as ' ' like below\
\
Copy code\
\
```\
unclassified_data:\
id: unclassified_data\
kind: data\
policyVersion: default\
attr:\
exportControl: None\
dataClass: ''\
```\
\
but what I'd really like is to be able to pass a resource thats missing this attribute and be able to detect it in the policy. Maybe something like\
\
Copy code\
\
```\
unclassified_data:\
id: unclassified_data\
kind: data\
policyVersion: default\
attr:\
exportControl: None\
---\
\
- all:\
of:\
- expr: !exists(R.attr.dataClass)\
```\
\
Does anyone have a neat way of doing that?\
\
\
\
\
\
- 3\
- 3\
\
d\
\
Dewansh Thakur\
\
08/20/2025, 6:58 AM\
\
Hey there I trying to access the policies via embedded PDP, I just successfully generated the polices but I can't find the embedded link (e.g. " [https://lite.cerbos.cloud/bundle?workspace=...&label=](https://lite.cerbos.cloud/bundle?workspace=...&label= "")...") in the new UI, can someone please guide me on this?\
\
a\
\
- 2\
- 1\
\
f\
\
Florent P.\
\
10/06/2025, 11:13 AM\
\
Hello, I have just created a Cerbos Hub account and started playing around with it. However, I am now unable to log in to hub.cerbos.cloud. Immediately after the login phase, I get a 500 error with the message ‘Something went wrong. Unexpected Server Error’. Thank you for your help.\
\
\
\
- 2\
- 4\
\
l\
\
Ludovic Galibert\
\
11/06/2025, 1:19 PM\
\
hi folks, we have a setup where our main app using cerbos and the cerbos service are on the same container, so it's all local over gRPC, but we're getting errors\
\
```\
NotOK: gRPC error 14 (UNAVAILABLE): Stream refused by server\
```\
\
CPU usage looks fine overall so it doesn't seem to need vertical scaling, but could it be possibly due to the\
\
```\
requestLimits\
```\
\
? We're using the default (50), maybe we need to bump that? How would I go about figuring out the potential culprit? Thanks for your help 🙏\
\
\
\
- 2\
- 8\
\
s\
\
Steven Bressey\
\
11/12/2025, 6:22 AM\
\
Hi everyone.\
We are currently upgrading our cerbods instance to 0.47.0 and just saw that\
\
```\
compile.cacheDuration\
```\
\
and\
\
```\
compile.cacheSize\
```\
\
configuration entries have been deprecated.\
I didn't see anything related to cache configuration in the release notes for this version.\
Does that mean compiled policies are not cached anymore ?\
\
\
\
- 2\
- 7\
\
c\
\
Clint\
\
11/14/2025, 5:43 AM\
\
Hi,\
We've been exploring Cerbos for some internal use cases and have been particularly looking at one case where we would like to apply a series of label's to a user. I've created the following use case in the playground just for trial purposes but continue to get an empty output for computed\_labels:\[\]\
Feel a bit stupid at the moment and cant work out the issue so would anyone be able to provide some quick hints on where we’re going wrong here?\
Thanks very much in advanced\
\
\
\
\
\
- 3\
- 6\
\
b\
\
Benjamin Rupp\
\
12/04/2025, 2:37 PM\
\
Hi there\
I found an issue that I perceive as a bug with role policies, if a user has two role policies with conditions\
\
b\
\
\
\
\
\
- 4\
- 8\
\
b\
\
Benjamin Rupp\
\
12/11/2025, 11:10 AM\
\
Good day everyone,\
The fix that you provided to the issue we raised above, rolled out in 0.49.0, is breaking our implementation due to a perceived change in evaluation. I was wondering if this is intended\
\
\
\
b\
\
- 3\
- 10\
\
s\
\
Stefan de Kooter\
\
12/18/2025, 4:11 PM\
\
hi team! In derivedRoles we're always initiating based on a parentRole provided by the Principle right..? When further restricting the role assignment using an expression, is there a special var we can use in this expression to refer to the value of the parentRole that's currently being evaluated?\
\
parentRole: banana\*\
expression: CurrentlyEvaluatedParentRole.EndsWith('pop')\
\
\
\
\
\
- 2\
- 2\
\
\
\
Sam Lock (Cerbos)\
\
02/13/2026, 5:48 AM\
\
Apologies for the delay, this message passed me by!\
\
Role policies are a special case--they're best thought of ACLs layered on top of the existing, authoritative rules defined in the resource policies. Anything allowed by a role policy **must** also be allowed by the resource policies in the same evaluation. Any\
\
```\
(resource, action)\
```\
\
pairs _not_ defined by the role policy are implicitly denied by that role policy.\
\
s\
\
Slackbot\
\
02/15/2026, 12:41 AM\
\
**@Nishant Vartak** joined #help. They’re also new to Cerbos Community.\
\
c\
\
Cosmin Marginean\
\
02/26/2026, 4:57 AM\
\
Hi\
\
I have question about\
\
```\
lambda\
```\
\
in resource planner: [https://docs.cerbos.dev/cerbos/latest/api/index.html#resources-query-plan](https://docs.cerbos.dev/cerbos/latest/api/index.html#resources-query-plan "")\
From our tests and the provided examples, there are a few implied, but not explicit assumptions that I wanted to verify\
1\. a\
\
```\
lambda\
```\
\
would only appear as a child of another expression and never directly as a child of\
\
```\
filter.condition\
```\
\
2\. the\
\
```\
variable\
```\
\
in a lambda is never an attribute, it's always a name for how the variable would be referenced inside the lambda\
3\. the actual attribute that a lambda\
\
```\
variable\
```\
\
refers to is always the\
\
```\
variable\
```\
\
in the _parent_ expression.\
Are these assumptions correct?\
\
\
\
\
\
- 3\
- 5\
\
v\
\
Venkatesh Rachapudi\
\
03/09/2026, 1:27 PM\
\
hi Cerbos team , we have few questions about how PDP gets refreshed in all sidecars across all the application layers when using with opensource Cerbos , can we store ABAC profiles in our own DB instead of Github?\
\
\
\
- 2\
- 3\
\
t\
\
Theisz Eduard\
\
03/17/2026, 9:45 AM\
\
hi cerbos team,\
\
i have a question regarding modelling our policies. We started with a strict list of actions that were allowed for each entity, (the classic CRUD plus some extra ones that we thought would come handy). And it was working fine, each resource always had the same actions and we were able to map those actions both on the UI as well as in the backend.\
\
Now we are adding some commands on each resource that were not planned from the beginning and I found 2 ways of doing this.\
\
1\. We keep the list of actions locked just like before, but each command will now be modelled as a resource with Actions like Read and Execute. Towards the ui we can create a Tree of permissions now with the resource and its allowed actions and then for each such command.\
2\. We allow the list of actions to grow, each command being then an action on the resource.\
Are there any pitfalls that you guys might have encountered following one or the other solution?\
\
\
\
- 2\
- 4\
\
a\
\
Andrew Bettke\
\
04/14/2026, 10:41 AM\
\
Hey again,\
\
We are looking for a way to validate policy expressions programatically. We leverage the dynamic backends and create/store policies mostly using the admin API + JSON payloads. We're running into an issue where we can sometimes inadvertently save policies with bad expressions in them. The API still allows us to save the policy, but then during checks the policy will fail to compile/evaluate leading to a nasty error rather than an ALLOW/DENY response. Is there a way to properly validate condition expressions programmatically? Or is the only viable way to catch these errors a save + mock check request to see if it can compile?\
\
p\
\
- 2\
- 3\
\
a\
\
Alex the seal\
\
04/20/2026, 5:02 AM\
\
Hi there,\
\
I'm currently evaluating Cerbos, which is a great tool for 95% of my use cases. I'm using Prisma as ORM.\
\
I'm working on a ReBAC setup with the following use case: an API should return a list of all Documents filtered by predefined policies.\
For example, a user can access a document if they own it, or if an accepted/removed contact (affiliatedUser) created the document on their behalf. There are of course multiple conditions, but this one is representative of what I'm trying to achieve.\
\
The PDP will then always return\
\
```\
PlanKind.CONDITIONAL\
```\
\
. The biggest risk right now is mapping the SQL query to the query that returns the list of documents.\
1\. How to express such ReBAC policy in Cerbos without pulling the entire database records?\
2\. How to reduce the risk of wrongly built SQL query because some\
\
```\
queryPlanResult.filters\
```\
\
are not applied correctly to the SQL query?\
Is this the right way to build the PDP with Cerbos?\
\
I couldn't find a clear way to handle this in the documentation, as it mainly covers RBAC and ABAC.\
\
Copy code\
\
```\
model Document {\
ownerId String\
owner User @relation(name: "DocumentOwner", fields: [owner_uid], references: [id], onDelete: Cascade)\
\
creatorId String\
creator User @relation(name: "DocumentCreator", fields: [owner_uid], references: [id], onDelete: Cascade)\
\
// ...\
}\
\
model User {\
id String @id\
contacts Contact[]\
\
contactAffiliations Contact[]\
// ...\
}\
\
enum ContactStatus {\
PENDING\
REFUSED\
ACCEPTED\
REMOVED\
DELETED_ACCOUNT\
}\
\
model Contact {\
id String @id\
\
ownerId String\
owner User @relation(name: "UserOwnsContact", fields: [ownerId], references: [id], onDelete: Cascade)\
\
affiliatedId String\
affiliatedUser User @relation(name: "UserIsAffiliatedWithContact", fields: [affiliatedId], references: [id], onDelete: Cascade)\
\
Status ContactStatus\
// ...\
}\
```\
\
\
\
Jan Kühnlein\
\
05/04/2026, 6:09 AM\
\
Does anyone else has problem with the 0.52.0 helm chart: it renders a bad image tag\
\
```\
<http://ghcr.io/cerbos/cerbos:@sha256:8d35a64e4a9989d732ff01a4046f879600c8e3b70cae47527236b759b07c3687|ghcr.io/cerbos/cerbos:@sha256:8d35a64e4a9989d732ff01a4046f879600c8e3b70cae47527236b759b07c3687>\
```\
\
Claude:\
\
Copy code\
\
```\
The chart's release tooling wrote the digest into the wrong field — should be digest: "sha256:...", but ended up as tag: "@sha256:...".\
```\
\
\
\
- 2\
- 2\
\
b\
\
Billy Bolton\
\
05/20/2026, 10:28 AM\
\
Hi folks,\
We've noticed when there's a malformed Cerbos policy that is added or updated, it can brick the system.\
\
Here's an example of such a policy where\
\
```\
request.resource.attr.\
```\
\
followed by\
\
```\
[\
```\
\
, which is not a valid CEL identifier reference:\
\
Copy code\
\
```\
apiVersion: api.cerbos.dev/v1\
description: repro\
rolePolicy:\
role: ug_example\
scope: tenant-uuid-placeholder.data\
parentRoles:\
- data_access\
rules:\
- resource: "*"\
allowActions: ["*"]\
condition:\
match:\
all:\
of:\
- expr: 'request.resource.attr.[category::a][key::b][type::c] in ["*"]'\
```\
\
Recovering from this state is difficult because it requires us to manually go into postgres to disable or delete the offending policy. Shouldn't there be input validation to avoid such things on the Cerbos side already though? Cerbos can surely catch this before reloading at runtime. Otherwise, we need to create these wrappers around it to catch it ourselves, which to me is a bandaid solution\
\
Note: We're currently on Cerbos v0.50.0 and cerbos-sdk-go v0.2.15\
\
\
\
\
\
- 3\
- 8