Decoupled authorization with Cerbos

Escape the chaos of intertwined authorization logic. Empower developers to focus on what truly matters: delivering exceptional products. Simplify, secure, and save with Cerbos.

if (await cerbos.isAllowed({ principal: user, resource, action: "edit" })) {
  // allowed
}

if (user.email.includes("@mycompany.com") ||
  (user.company.package === "premium" && user.groups.includes("managers"))
) {
  if(user.region === resource.region) {
    // access allowed
    AuditLog.record("ALLOWED", "edit", user, resource);
  } else {
    // access denied
    AuditLog.record("DENIED", "edit", user, resource);
  }
} else {
  // access denied
  AuditLog.record("DENIED", "edit", user, resource);
}

Before

After