AI agents have stayed at the center of almost every authorization conversation we have had, and the focus has sharpened. The question is no longer whether agents introduce risk, it is how teams govern them in production without slowing anything down.

A human in accounts payable would never wander into the compliance database. An AI agent with the same role-level permissions will, and as Replit showed, even when asked not to it can still delete the database anyway in 9 seconds. Our AI security overview lays out why agents are not creating new security problems, they are exposing the authorization gaps that already existed, just at machine speed, and what governing them properly looks like. On the same theme, we covered the blind spot in non-human identity management, and recapped IIW42, where agent authorization stopped being theory.

For security and business leaders, we published a deep look at the authorization management platform category and what good looks like, examined how centralized authorization governance cuts incident response time, and made the case for on-premise authorization in regulated environments.

On the standards side, we walked through how AuthZEN, Shared Signals, SCIM Events, and IPSIE are converging into a shared authorization stack.

For teams actively building, we shipped a Claude agent skill for writing authorization policies, a practical guide to writing, testing, and validating policies with AI help, and a new Cerbos PDP release (v0.52.0/v0.53.0) with engine performance work, security hardening, and CEL path functions.

Customer spotlight: BarrierSystems

BarrierSystems builds smart vehicle access gate systems. With Cerbos managing their access policies, they cut authorization-related support tickets by 75% and internal costs by 15%, while shipping new features faster.

Product Updates

Cerbos PDP

Versions v0.52.0/v0.53.0 of Cerbos PDP focus on the parts of the PDP that don't usually make headlines but matter every time a request hits the engine: faster decision generation, tighter security around JWT handling, and a handful of bug fixes that close out long-standing edge cases. 

v0.52.0 lands engine performance work and new CEL path functions, while v0.53.0 hardens the JWT verification flow and resolves a query plan regression introduced in v0.50.

You can find the full release notes here: v0.53.0

Cerbos PDP is open source, check out our GitHub

Helpful Content

[Checklist] The IAM security checklist for 2026

IAM gaps remain one of the most common root causes of breaches, and most teams don't have a clear picture of where they stand. 

This checklist is a practical, priority-ranked assessment of the IAM controls that matter most in 2026, built from what we've learned working with enterprise security teams, industry experts, and leading identity events including Gartner IAM, Identiverse, and EIC.

Upcoming Events

Visit our booth at:

• EIC, Berlin, May 19-23. Stop by the Cerbos candy bar on level C for a chat! Cerbos' CPO and co-founder, Alex Olivier, will be on two panels worth blocking time for:

  • “Signals, policies, and identity agency: A smarter identity layer” Hear how identity platforms are moving from static rules to continuous, signal-informed decisioning.
  • “Leverage OpenID AuthZen to enable consistent fine-grained access control at scale and provide visibility & accountability across your it landscape” 
• Identiverse, Las Vegas, June 15-18. Stop by the Cerbos booth 925 for a proper chat about all things authorization. Three sessions to add to your schedule:
  
  • Catch Alex and Vatsal Gupta from Apple in "Access reviews are dead. Long live decision governance". Stop by and let us know what you think!
  • Join the panel “Beyond authentication: Updates from the authorization frontier” with Alex.
  • Sit in on the “AuthZEN Deep Dive: mastering the OpenID authorization standard” talk with Alex, Atul Tulshibagwale, and Mark Berg.

Meet our team members and check out their talks to get valuable insights:

• WeAreDevelopers World Congress, Berlin, July 8-10. Drop by Alex’s talk “The day the chatbot asked for sudo” if you are anywhere near AI security work right now.