Cerbos Newsletter [09 Dec 2022]

Hello from Cerbos!

Our December newsletter includes :

Embedded Authorization - Join us in alpha testing!

Cerbos Lite is a version that doesn’t require running a Cerbos Service instance. Policies are compiled into a static bundle that can be included in apps. This enables on-device authorization checks, consistent authorization, anywhere your application runs. Interested?
Click here to book a session

Design the Future of Cerbos - Book a session!

Having spoken to many of Cerbos’ users, having a workflow to author and manage policy is a top request - we have been working away on this and are looking for some keen users to test out this new way of using Cerbos.
Click here to book a session

Updates to Cerbos

Cerbos v0.23

The latest release of Cerbos, v0.23, includes updates to the cerbosctl, improved query plans and updates to the Helm charts and more.

Cerbos events

Are you thinking about designing a scalable authorization process for your product? If so, don’t miss out on the talk Alex Olivier, Product Lead at Cerbos, will be hosting on Codementor.
The talk will be held on Nov 9, 6:30pm (GMT). If you are not able to attend the live event, you can always watch the recording at a later time.
Sign up for the talk here

Blog highlights

Threading together fine-grained auth with Stytch and Cerbos

Read the full blog post to review a demo, in which we set up a Python FastAPI service, using Stytch's Email Magic Links for authentication, and Session Management for "just-in-time" identity verification; and roll it all up with Cerbos' decoupled authorization for fine-grained access control.

How Utility Warehouse upgraded and centralized its access control system with Cerbos

Utility Warehouse wanted to upgrade its cumbersome in-house authorization system. Rob Crowe, the Principal Engineer at Utility Warehouse, selected Cerbos to centralize how the company managed user permissions.
We spoke to Rob to discover why Utility Warehouse chose to scrap its in-house authorization system and implement Cerbos — and the excellent results that came from the partnership.

What is Cerbos?

Cerbos set early in 2021, not to reinvent the wheel, but to make authorization a clearer and simpler part of your application. Generally, there is a lot of complicated logic that goes into creating authorization permissions in an application. We sat down with our own Alex Olivier to go over what Cerbos is, and why it should be the go to for authorization.
Read the full blog post, in which we answer the top FAQs we have received.

Planning user roles for your application

When building a web application with authenticated users, it’s important to define which users can perform which actions. In this article, we dig into how to best set up your user roles. You’ll also learn how to ensure these roles are granular enough and how to think about changing user roles over time. Finally, we’ll briefly touch on the benefits of delegating role management to Cerbos so you can focus on your application logic.
Read the full article to find out more about role management and planning user roles for your application.

Badly designed authorization is technical debt

As software engineers, we often think about authorization in terms of access control and authentication. We design our systems with a combination of user-friendly signup flows and secure logins. However, we don't consider the authorization of users once they're inside our application.
Discover a better way to handle authorization, rather than hard coding access controls, by reading the full article.

Designing an authorization model that scales with your business

Authorization logic includes a lot of layers and a lot of places for things to go wrong. From top-level concerns like assigning permissions to the fine-grained aspects of securing access to individual endpoints, each stakeholder involved must get things right for it to work.
Read the full blog post for pointers on designing an authorization model, some key moments in the growth of a company, which will trigger roles and permissions to evolve, and why leaning on decoupled, self-hosted authorization layers like Cerbos is becoming more and more common.

Dynamic policy management with the Admin API

Cerbos allows you to store your policies in a variety of ways. Sometimes, there might be a use-case for more dynamic management of your policies. Cerbos provides interfaces to various database backends (SQLite, Postgres, MySQL and SQL Server), which allow you to create, update, and retrieve policies and schemas via the Admin API.
Review the following demo, which shows a simple implementation of a backend Go service which interfaces with the Admin API, and provides a React-based front end with an editor for creating, validating, and updating policies.

Industry news

The Decoupling Principle and multi-party privacy

The Decoupling Principle is a well-known but unwritten law: to ensure privacy, information should be divided architecturally and institutionally so that each entity (such as a company) has only the information they need to perform their relevant function. Read the full article to see the value of separating who you are from what you do.

The Guild rollout of free Single Sign-On for GraphQL Hive organizations

SSO is now available and free on any plan, as per requests from GraphQL Hive Cloud and self-hosted users. Read the full post to see why gatekeeping basic security functions is becoming less popular.