cerbos-embedded-pdp
Cerbos embedded PDP
An embedded PDP (ePDP) evaluates Cerbos policies in-process inside a WebAssembly module, with no network call per check. @cerbos/embedded-client downloads a policy bundle from Cerbos Hub and holds it in memory; @cerbos/embedded-server supplies the WASM engine that evaluates it. The engine carries no policies and changes only when that package is upgraded.
The ePDP is a Cerbos Hub capability. Bundles are built and served by Hub, from an ePDP rule on a deployment, so the policies have to reach a Hub policy store first (Hub getting started). Where there is no Hub account, every check is a network call to a service PDP.
Scope
This skill owns the embedded PDP: ePDP rules on a Hub deployment and the bundle filtering they apply, @cerbos/embedded-client wiring, loading the WASM module per bundler and runtime, and the checks a browser, React Native app, edge worker or serverless handler makes against the bundle.
Route adjacent work elsewhere:
- Server-side enforcement — API routes, server actions, middleware, resolvers and RPC handlers calling a service PDP — belongs to
cerbos-pep-integration, including the service PDP check behind every endpoint a browser ePDP renders for. - The policies a bundle carries, and getting them into a Hub policy store, belong to
cerbos-policy. Filtering which of them reach a client stays here (references/RULES.md). - Standing up Cerbos Hub, its deployments and client credentials belongs to
cerbos-hub-setup; creating ePDP rules on a deployment stays here.