AuthZEN, the open standard for how applications ask for an authorization decision, is being extended to AI agent tool calls and approvals by a person. Our CPO Alex Olivier, who co-chairs the working group, presented the new work at the Internet Identity Workshop, after he and Vatsal Gupta of Apple spoke at ISC2 Security Congress on supply chain breaches that start with a stolen identity. Identities, human and machine, and what they can reach ran through much of what we wrote this month.

For security and identity leaders, we wrote up how, with our new iProov partnership, a real human whose liveliness has been verified, can approve an AI agent’s action, like a payment, before it runs. We explained AI identity and access management and why an agent’s identity still needs every action checked. We mapped the enterprise IAM stack, and argued that coding agents should follow rules set for the whole organization, not by each developer.

For builders, we showed how to check every call to an outside AI model against policy before it leaves the network, and how we authorize MCP tool calls internally. Alex talked about AI agents on the Code Story podcast and AuthZEN on the Application Security Weekly podcast, and our CEO Emre Baran explained on SoftwarePlaza why AI agents need predictable rules.

If your team uses Oso and has been following the news about its change of ownership, here is a comparison of Cerbos and Oso and a migration guide to moving from Oso to Cerbos.

We also released Cerbos PDP v0.57.0, which keeps large policy stores serving requests while they reload and makes syncing audit logs to Cerbos Hub lighter on CPU, memory and disk, as well as Cerbos Synapse v0.10, which gives teams a clear record of the data that reaches their authorization policies and what each source adds.

Customer spotlight: Complex

Complex (formerly NTWRK), the live shopping platform serving millions of sneaker fans and collectors, manages every application permission from one place with Cerbos. Shoppers, sellers, brands and admins each get the access their role allows, every rule is tested before it ships, and engineers spend their time on features instead of permission code. Onboarding a new developer onto Cerbos takes an hour.

Product Updates

Cerbos is an end-to-end authorization management platform. Its four components, Cerbos Hub, Cerbos Synapse, Cerbos PDP and the Cerbos PEP SDKs, work together to give teams a single layer that governs every action and proves every decision. See how Cerbos works.

Cerbos Synapse

The latest Cerbos Synapse release gives teams a clear record of the data that reaches their authorization policies, and what each source adds. Here’s what’s new in v0.10.

• Self-documenting extensions. Each extension, such as one that pulls user details from an identity provider, now states its purpose and the attributes it adds to authorization requests. Synapse combines them into one list of every attribute the instance adds.

• Instance details on demand. Teams can see what a running Synapse instance and its extensions do, as structured data for tools or as a readable page for people. Both can be switched off in configuration.

• Latest Cerbos PDP. Synapse now runs Cerbos PDP v0.57.0, so it picks up the improvements above.

You can find the full release notes here: v0.10

Cerbos PDP

The latest Cerbos PDP release keeps large policy stores serving requests while they reload, and makes audit log syncing to Cerbos Hub lighter. Here’s what’s new in v0.57.0.

• Reloads that keep serving. A very large policy store reloads in full while the PDP keeps answering requests.

• Lighter audit log sync. PDPs that send decision logs to Cerbos Hub use less CPU, memory and disk, with nothing to configure.

• Consistent filtered lists. Lists filtered by policy now apply the same “does this field exist” checks as single permission checks.

• Upgrade note. Teams with their own query plan handler or adapter should confirm it supports the new has operator, so please check the release notes before upgrading.

You can find the full release notes here: v0.57.0
Cerbos PDP is open source, check out our GitHub

Helpful Content

The IAM security checklist for 2026

IAM gaps remain one of the most common root causes of breaches, and most teams don't have a clear picture of where they stand. 

This checklist is a practical, priority-ranked assessment of the IAM controls that matter most in 2026, built from what we've learned working with enterprise security teams, industry experts, and leading identity events including Gartner IAM, Identiverse, and EIC.

Upcoming Events

Meet our team members and check out their talks to get valuable insights:

• Gartner Identity & Access Management Summit, Las Vegas, December 7 to 9. Governing AI agents and machine identities are on this year’s agenda, and our CPO Alex Olivier will be there. If you are attending too, feel free to message him on LinkedIn to set up a time to talk in person.