Our CPO Alex Olivier spent part of September in San José at WeAreDevelopers World Congress, talking through the incidents that start when authorization is spread across services, gateways, data platforms and AI systems and each one decides on its own. The agent security sessions there made a related case, that what an agent may do should be enforced outside the model, with its own identity and access granted explicitly. Both ideas ran through a lot of what we wrote this month.

For engineering and security leaders, we looked at who owns authorization in a large organization, why it falls between the identity, security and architecture teams, and how to give each team a clear part of it. We broke down a zero trust stack layer by layer with the tools in each, including the per request authorization layer most programs leave inside application code. And we covered why an audit trail goes dark when one AI agent hands work to another.

For builders, we covered how Rich Authorization Requests let an agent's token say exactly what it may do at each step, how to read attributes from the database at decision time instead of copying them into tokens, how to filter a list by policy with one query, and how to move Kafka topic access into the same policy set as the rest of the stack.

We also just released Cerbos PDP v0.56.0, which confirms a policy change is live before a CI/CD pipeline moves on, and gives teams a metric to alert on when any instance stops picking up new policies. Last but not least, the Cerbos PDP dashboard is now on Grafana Cloud, putting a whole fleet's health, loaded policies and latency on one screen.

🌐 Partner with Cerbos

Thank you to our partners who already bring fine grained authorization to their clients with Cerbos! If your team delivers identity, platform or zero trust projects, you can offer your clients the same and make authorization a new line of billable work, with our solution architects backing your consultants from the first project. Become a partner here.

Product Updates

Cerbos PDP

The latest Cerbos PDP release gives teams proof that a policy change is live, and a way to spot any PDP that falls behind. Here's what's new in v0.56.0.

• Confirmed policy reloads. A CI/CD pipeline can now wait until new policies are compiled and live before its next step.

   

• Policy freshness metric. Teams can alert on any PDP that has stopped picking up policy changes.

   

• Upgrade note. A few long-deprecated settings were removed, so check the release notes before upgrading.

The Cerbos PDP dashboard is also now on Grafana Cloud, showing every PDP's health, loaded policies and latency on one screen, with nothing new to configure.

You can find the full release notes here: v0.56.0
Cerbos PDP is open source, check out our GitHub

Helpful Content

[On-demand webinar] A guide to layered security that holds up under pressure

Most zero trust strategies are built in layers, identity, authentication and access management, and on paper they look solid. What matters is what catches a threat when one of those layers fails.

Aviation answered that question decades ago with the Swiss Cheese Model. Every layer has holes, and incidents happen when the holes line up.

In this 45 minute session, our CPO Alex Olivier, co-chair of the OpenID AuthZEN working group, applies that model to runtime security. He covers the six layers of zero trust, from identity and authentication through privileged access, entitlements, and coarse and fine grained authorization. He shows where most organizations still have gaps, and why it is now realistic to put zero trust in place end to end.

It will be useful for security leaders making the case to the board, and for the engineers who will put it in place.

Upcoming Events

Meet our team members and check out their talks to get valuable insights:

• ISC2 Security Congress, Gaylord Rockies, October 28. Check out Alex Olivier's talk “Identity as the Control Plane for Software Supply Chain Security”, co-presented with Vatsal Gupta of Apple, on the supply chain breaches that start with a compromised identity rather than tampered code, and how to govern human and machine identities across CI/CD without slowing engineering down.
• Internet Identity Workshop, Mountain View, November 3 to 5. Alex will be there too. If you are attending, message him on LinkedIn if you’d like to set up a time to talk in person.