🔐 New: A CISO’s benchmark for authorization maturity ➔ [Download the ebook](https://solutions.cerbos.dev/authorization-maturity-model-a-cisos-benchmark)

## Success story

# Flash eliminates authorization technical debt and doubles corporate card spending with Cerbos

A Brazilian fintech replaces a legacy custom policy service with Cerbos to deliver flexible, real time expense controls to corporate clients, driving increased confidence and card usage.

2x increase in corporate card spending for companies using policy controls

6,000+ policy rules managed in real-time for regulated payment transactions

Authorization for hundreds of companies without scaling engineering headcount

“What caught our attention was the deployment modes, which were very adherent to our new infrastructure running Kubernetes. We could choose to run as a server or as a sidecar. And it was focused on performance and easier to integrate than other solutions out there because Cerbos uses JSON or YAML; you choose.“

[Paulo Henrique Pereira Cardoso, Tech Manager at Flash](https://www.linkedin.com/in/ph-pc/)

### Summary

Flash is one of Brazil's leading employee benefits and expense management platforms, serving 2 million users and more than 60,000 companies. Their expenses business unit manages their customers’ corporate card usage, reimbursements, and travel expenses for thousands of clients.

Flash implemented Cerbos to externalize authorization for easier policy management, achieving a 2X increase in corporate card spending for companies that use policy controls, and eliminating technical debt from a difficult-to-maintain legacy authorization system.

Fine grained, contextual, continuous authorization for enterprise software and AI

[Try Cerbos Hub](/content/product-cerbos-hub/index.html)

# Introduction

Flash is one of Brazil's leading employee benefits and expense management platforms, with over 1,000 employees across the organization. The company began by solving a uniquely Brazilian problem: strict labor legislation requires companies to provide employee benefits through specialized cards, but employees struggled to use them because acceptance varied widely between merchants.

"Our first proposal was to unify all these perks in a single card and eliminate the question that over here was very common: do you accept this card or that? People tend to accumulate their balance because they cannot use it properly," said Paulo Henrique Pereira Cardoso, Tech Manager at Flash.

Flash's growth then accelerated through a strategic merger with a travel and expenses company. This acquisition opened up a new market opportunity: corporate cards for business expenses. Unlike benefit cards tied to labor legislation, corporate cards serve a smaller subset of employees, typically 5-10% of a company's workforce, but with higher transaction values and more complex spending requirements.

The merger positioned Flash to offer a comprehensive solution spanning the entire spectrum of employee payments: benefits, travel, expenses, and corporate purchasing. However, it also introduced significant technical challenges. The acquired company operated on a completely different technology stack, and Paulo, who joined as Flash's first hire and grew with the company through its evolution, knew the team needed to make strategic decisions about which systems to carry forward.

**Flash's vision for the new corporate card product was ambitious: enable companies to set their own spending policies.** Store managers needed different limits than C-level executives. Some companies wanted to restrict alcohol purchases. Others needed to enforce cost center budgets or limit spending to business days only. Each client had unique requirements that reflected their organizational structure and corporate policies.

**To deliver this level of flexibility at scale across thousands of corporate clients, Flash needed a modern, maintainable authorization infrastructure.** One that could handle real time decisions during payment processing while remaining simple enough for their engineering team to abstract and expose to clients.

# Business needs

When Flash merged with a travel and expenses company, they inherited a technology stack with significant technical debt. The legacy policy service was custom built, slow to execute, and difficult to maintain.

Rather than investing resources in understanding and extending a problematic codebase, Flash's engineering team made the strategic decision to build a new travel and expenses product from the ground up. This presented an opportunity to select a modern, maintainable authorization solution that could scale with their business.

"We thought, someone has already solved this problem. This is a common problem. It's not possible I'll have to write this from ground zero. Someone has already done it well. We should find a tool to help us," Paulo explained his thought process.

Each of Flash's corporate clients has unique spending policies. Some companies want to restrict meal purchases to $150 on business days. Others need to enforce cost center budgets, deny alcohol purchases, or set different limits for managers versus employees. **Flash needed a solution that would enable them to build an abstraction layer where clients could define their own rules** without requiring Flash's engineering team to write custom code for every use case.

The key requirements were clear:

- **Flexible deployment options** that integrate seamlessly with their Kubernetes infrastructure
- **High performance** to handle real time authorization decisions during credit card purchase transactions
- **Easy integration** using familiar data structures rather than proprietary policy languages
- **Policy abstraction** that would allow clients to build their own rules through a user interface
- **Support for attribute-based access control** to enable complex business rules beyond simple role-based permissions

Additionally, Flash needed a solution that wouldn't lock them into a proprietary policy language with a steep learning curve. Their engineers wanted to work with familiar data structures and avoid creating another maintenance burden.

"Most other solutions have their own language, so there is a learning curve there. Do I really want to learn this language or that? Cerbos, by using JSON or YAML, helped me in both ways. One, we already know how to handle these data structures, so it's fairly simple. And two, it's easier for me to abstract the Cerbos layer and hand it over to my client."

[Paulo Henrique Pereira Cardoso, Tech Manager at Flash](https://www.linkedin.com/in/ph-pc/)

### Evaluation

After evaluating several authorization solutions, Flash selected Cerbos for its deployment flexibility, performance characteristics, and developer friendly approach to policy definition.

"What caught our attention was the deployment modes, which were very adherent to our new infrastructure running Kubernetes. We could choose to run as a server or maybe as a sidecar. And it was focused on performance and easier to integrate than other solutions out there because Cerbos uses JSON or YAML; you choose," said Paulo.

Flash implemented Cerbos as a centralized policy decision point for their expenses business unit, which serves 30-40 engineers across product, security, engineering, and design functions. The team built an abstraction service that interacts with Cerbos, enabling their corporate clients to build spending policies directly through the Flash interface.

The use of standard data formats was crucial to Flash's implementation strategy. Because their engineers already understood these data structures, they could quickly build a policy abstraction layer that exposed building blocks to clients; for transaction amounts, dates, locations, user attributes, and role hierarchies. All without requiring clients to understand Cerbos directly.

Flash's implementation went live mid-2025, and the full rollout across their corporate card user base happened throughout the year. The policies are evaluated in real time during the authorization phase of credit card purchases, providing instant feedback to cardholders while protecting company budgets.

The system now handles authorization for multiple transaction types. These include credit card purchases at point of sale, online transactions, reimbursement approvals, and receipt validation for expense reports with item level restrictions.

Companies can define policies based on multiple attributes:

- **Role-based controls.** Different spending limits and permissions for store managers, account managers, sales representatives, and C-level executives
- **Cost center attribution.** Policies tied to specific departments or budget codes
- **Transaction attributes.** Rules based on purchase amount, merchant category, time of day, and business days versus weekends
- **Item level restrictions.** Ability to allow or deny specific purchase categories like alcohol or cigarettes for reimbursement

# Results

The implementation of Cerbos-powered policy controls has delivered measurable business impact for Flash and their corporate clients.

## 2X increase in corporate card spending

The most significant metric Flash tracks is corporate card spending growth. Companies that implement policy controls through Flash's system spend approximately double what companies spend without such controls. This full year data from 2025 demonstrates that authorization isn't just a technical requirement. It's a business enabler.

"Companies that use the policy system tend to spend about double through the credit card, when compared to those who don't use such controls. The client gets more confident that the money will not be misused."

[Paulo Henrique Pereira Cardoso, Tech Manager at Flash](https://www.linkedin.com/in/ph-pc/)

When companies have confidence that spending will stay within defined parameters, they're willing to expand card usage across more employees and use cases. This dramatic increase translates directly to revenue growth for Flash's expenses business unit.

## Faster time to market

Flash got their new corporate card product to market 3-4 months earlier than if they had rebuilt authorization from scratch, enabling them to start generating revenue from the 2X spending increase sooner.

## Real time authorization at scale

Flash processes thousands of authorization decisions in real time during payment card purchase transactions. The performance characteristics of Cerbos enable sub-millisecond policy evaluation, ensuring that legitimate purchases aren't delayed while still protecting against policy violations.

The system handles both point-of-sale and online transactions, evaluating complex policies that consider transaction amount, time of day, merchant category, user role, and item level restrictions. All without latency impact on the customer experience.

## Reduced maintenance burden for engineering teams

With Cerbos handling authorization logic, Flash's 30-40 engineers across the expenses business unit no longer spend time maintaining custom authorization code. The team can focus on product features rather than authorization infrastructure.

The elimination of technical debt from the legacy authorization system has improved development velocity and reduced the risk of authorization-related bugs, security vulnerabilities, and knowledge loss when team members leave. What used to require understanding complex, poorly documented code now simply requires updating policy files in familiar JSON or YAML format.

## Enhanced client experience

Flash's corporate clients can now:

- Define custom spending policies through an intuitive interface.
- Implement role-based controls that match their organizational structure
- Set item level restrictions to comply with company policies
- Adjust policies in real time without waiting for Flash's engineering team
- Trust that authorization decisions happen instantly at the point of purchase

The abstraction layer Flash built on top of Cerbos enables clients to self-service their policy management, reducing support tickets and improving overall satisfaction with the platform.

# Looking ahead

While Cerbos currently powers authorization in Flash's expenses business unit, the team sees significant potential to expand its use across the organization's other business units: benefits, and HR tools.

This potential expansion demonstrates the value of selecting a flexible, scalable authorization solution. Rather than building or buying specialized tools for each use case, Flash can leverage their existing Cerbos investment across multiple products and business units, reducing both integration complexity and total cost of ownership.

The Flash team's approach of evaluating Cerbos for each new authorization use case reflects a broader architectural principle: consolidating on proven solutions rather than proliferating point tools. As Flash continues to grow and add new features, having a centralized authorization platform will become increasingly valuable for maintaining consistency, reducing maintenance burden, and accelerating time to market.