Cerbos Route Extensions | Infrastructure Authorization Endpoints | Cerbos

Authorize requests from any infrastructure component

Route extensions expose HTTP endpoints that gateways, proxies, data platforms, and queues call to delegate access control to Cerbos policies — translating each system's native protocol into a policy evaluation.

Documentation

How Cerbos works with Route Extensions

Route Extensions provides a native integration point for Cerbos, extending policy-driven authorization to another layer of your stack without custom glue code.

Cerbos policies are written in human-readable YAML supporting RBAC, ABAC, and conditional rules. The same policies that govern your application layer now extend to Route Extensions, enforced consistently everywhere.

Protocol translation for infrastructure authorization

Many infrastructure components — API gateways, service meshes, data platforms, message queues — have hooks for delegating access control to an external service. Each speaks a different protocol. Route extensions, a core component of Cerbos Synapse, accept these requests, translate them into Cerbos policy evaluations, and return responses in the format the calling system expects.

This creates a single policy surface across your entire stack. The same policies and attribute vocabulary that govern your application layer extend to your infrastructure, with a unified audit trail.

How route extensions work

  1. An infrastructure component sends a request to a route extension endpoint using its native authorization protocol.
  2. The extension translates the request into a Cerbos policy evaluation using declarative CEL expressions or a programmable Starlark/Wasm extension.
  3. Policies are evaluated and the decision is translated back into the response format the calling system expects.

Declarative CEL mapping handles straightforward protocol translations as configuration. Programmable extensions in Starlark or Wasm handle complex transformation logic.

Get started

Route extensions are available as part of Cerbos Synapse. Talk to us to learn more about extending Cerbos authorization to your infrastructure.

FAQ

What are route extensions?

Route extensions expose HTTP endpoints on Cerbos that accept requests in any format, translate them into Cerbos policy evaluations, and return responses in the format the calling system expects. This enables any infrastructure component with an external authorization hook to delegate decisions to Cerbos.

What systems can use route extensions?

Any system that supports delegating access control via HTTP or gRPC. Common examples include API gateways, service meshes, data platforms like Kafka and Trino, message queues, and internal tooling with ad-hoc authorization logic.

What is the difference between declarative and programmatic mapping?

Declarative mapping uses CEL expressions to define the protocol translation as configuration. Programmatic mapping uses Starlark scripts or Wasm modules when the transformation logic is more complex than CEL can express.

Cerbos + Route Extensions