Cerbos Authorization Migration

Find the rules that already exist, extract them into a spec, map them onto the Cerbos model, and cut over behind a shadow period.

Scope

This skill owns the migration record and plan: the guard inventory, the Structured Intent spec, the construct mapping and gap register, and the shadow and cutover plan. It produces no policy YAML.

Route adjacent work elsewhere. A full migration loads two of these on the way: cerbos-policy at Phase 4 writes the policies and suites, and cerbos-pep-integration at Phase 5 writes the SDK call inside each shim. Write neither from this skill.

• Policy files, *_test.yaml suites, validation and the upload belong to cerbos-policy (Policies). Phase 2 produces exactly the spec its intake consumes. With no existing authorization to move, go there directly.
• Standing up a Cerbos Hub policy store and deployment belongs to cerbos-hub-setup.
• The SDK call in each shim, attributes the PEP resolves before calling, and query plan adapter wiring belong to cerbos-pep-integration.
• Attributes fetched inside the authorization path by a Synapse data source belong to cerbos-synapse-extension.
• Querying the audit log and Insights during shadow and after each flip belongs to cerbos-audit-insights.

What the move buys