🔐 New: A CISO’s benchmark for authorization maturity ➔ Download the ebook

Flexible policy conditions powered by Google CEL

Experiment with writing CEL conditions, enjoy a seamless policy development experience.

Seamless policy development

Google Common Expression Language, CEL, enables Cerbos policies to offer powerful capability to define conditions that are evaluated against the data provided in the request. CEL is a robust language designed for simplicity, speed, and safety. With Cerbos' interactive REPL, you can experiment with writing CEL conditions, providing a seamless experience for policy development.

Key features

Operators and functions:

• Logical operators: Define conditions using common logical operations to check for values, compare attributes and more.
• Built-in functions: Utilize a wide range of built-in functions and operators in CEL such as working with lists, maps and timestamps.
• Cerbos-specific extensions: Use Cerbos-specific functions for handling hierarchies, IP addresses, and more.

Policy variables and auxiliary data:

• Avoid duplication: Define variables to avoid repetitive condition expressions.
• Auxiliary data: Access additional data sources, like JWT, in your policies.

Basic CEL condition example

condition:
 match:
    all:
      of:
        - expr: request.resource.attr.status == "PENDING_APPROVAL"
        - expr: >
            "GB" in request.resource.attr.geographies

Using the power of CEL, conditions can be as fine-grained as your business requirements, making use of all the request context to compute an authorization decision.