Cerbos Embedded Policy Decision Point

Redesigned embedded policy decision point architecture

A completely redesigned embedded policy decision point (ePDP) system replaces the previous implementation.

Per-deployment ePDP rules

Each deployment can define multiple ePDP rules, allowing different bundle configurations for different clients or environments.

Policy filtering for ePDP bundles

Specify which resources, actions, scopes, roles, and versions to include in ePDP policy bundles, reducing bundle size and limiting exposure of server-side authorization logic.

Dynamic scope filtering

Require clients to specify scopes at fetch time, enabling multi-tenant architectures where each tenant receives only their applicable policies.

Access controls per ePDP rule

Configure authentication requirements (public access or client credential) and IP allowlists per ePDP rule.