Cerbos Hub setup

Get from policies on disk to a PDP serving Hub-built bundles, and keep it running.

Scope

This skill owns Cerbos Hub itself: policy stores and their sources, deployments, client credentials, PDPs configured to fetch a deployment's bundles, and running that afterwards — pushing changes, builds, freeze and rollback, monitoring and diagnosis.

Route adjacent work elsewhere:

• Writing, changing and testing the policies a store holds belongs to cerbos-policy. When a build fails at Compile or Test, the fix to the policy or suite is made there.
• Application code that calls the PDP belongs to cerbos-pep-integration, and ePDP rules and browser or edge checks to cerbos-embedded-pdp.
• Enabling and masking audit logs and reading Hub Insights belong to cerbos-audit-insights; the Read & write deployment credential that Hub audit collection needs is created here (Step 1).
• Pointing Synapse's in-process PDP at a deployment belongs to cerbos-synapse-extension.

Secrets

A client secret travels from the Hub console to the process that uses it without passing through you. The transcript is a log that gets scrolled, screen-shared and pasted into tickets, so a secret that lands there is exposed. Every script under scripts/ reads secrets from the environment and reports them only as set or unset, and every command you write holds to the same rule.