Cerbos Synapse Extension

Synapse extends the Cerbos authorization pipeline. Five extension kinds × multiple runtimes. Pick kind → runtime → load the matching reference.

Scope

This skill owns Synapse extensions of every kind and runtime, their *_test.star suites, and the extension wiring in Synapse config.yaml and local compose files. Call mapper CEL lives here too.

Route adjacent work elsewhere:

• Policies the extension's requests are evaluated against, including their *_test.yaml suites and CEL conditions, belong to cerbos-policy. When an extension adds attributes that a rule reads, write the extension here and the rule there.
• Application code that calls Synapse or the PDP belongs to cerbos-pep-integration; use this skill for the extension code and configuration.
• Standing up Cerbos Hub and its deployments belongs to cerbos-hub-setup; pointing Synapse's in-process PDP at a deployment stays here (references/shared/hub.md).

Extension Kinds