Cerbos Embedded Policy Decision Point (ePDP) is a client-side authorization engine that serves policy bundles to applications directly in the browser or other JavaScript environments. The ePDP architecture introduces per-deployment rules that allow each deployment to define multiple bundle configurations, filter policies by resources, actions, scopes, roles, and versions, and apply dynamic scope filtering so that multi-tenant clients receive only the policies relevant to their context. Access controls can be configured per rule, including authentication requirements (public or client-credential) and IP allow-lists.
The ePDP is accessed via the @cerbos/embedded-client JavaScript SDK, which replaces the previous @cerbos/embedded package and provides automatic bundle updates, deferred activation, and enhanced error handling. Deployment helpers generate bundler-specific code snippets for Vite, Webpack, Rspack, Next.js (Turbopack), and Node.js, and the SDK supports capturing audit decision logs from embedded deployments for centralized analysis.
