Cerbos PEP Integration

A PEP — policy enforcement point — is the code in your application that calls a PDP and acts on the answer. Policies decide nothing until a PEP asks.

Scope

This skill owns the application code that calls a PDP: the SDK client and its connection, isAllowed, checkResource and checkResources checks at the boundary of an operation, the mapping from your user store onto the principal, JWTs passed as auxData, list filtering with planResources and query-plan adapters, and the checks guarding AI agent and MCP tool calls.

Route adjacent work elsewhere:

• Browser-side checks that show, hide, enable or disable UI belong to cerbos-embedded-pdp; the server-side check that binds stays here.
• Writing or changing the policies themselves (Policies) belongs to cerbos-policy.
• Standing up Cerbos Hub and getting policies to a PDP belong to cerbos-hub-setup.
• Synapse extensions and their configuration belong to cerbos-synapse-extension; code that calls Synapse stays here.
• Audit logs, including telling a PDP outage from a deny, belong to cerbos-audit-insights.
• Moving checks out of existing code or another authorization system belongs to cerbos-authz-migration.

The PDP is stateless