Cerbos Synapse

Real-Time Context Assembly and Data Enrichment

Assembles and fetches identity, resource, and relationship context in real time at decision time from identity providers (including Okta, Entra ID, Cognito, and LDAP), SQL databases, graph stores, internal APIs, and data fabrics for zero-trust authorization without requiring custom middleware or PEP code.

Proxy Extensions and Transparent Request Enrichment

Intercepts CheckResources and PlanResources requests and responses to transparently add, modify, or remove attributes on the principal and resources before PDP evaluation, and rewrites or redacts sensitive fields (including output blocks) on the response before reaching untrusted callers while calling applications continue using the standard Cerbos API.

Route Extensions and Infrastructure Protocol Translation

Registers custom HTTP endpoints under the /ext/ path to connect enforcement points and authorize access across API Gateways, messaging queues, data platforms (such as Trino or Kafka), deployment pipelines, and custom gateways by translating native protocols into Cerbos calls without modifying upstream clients, enables running multiple translation layers simultaneously on distinct /ext/ paths from the same Synapse instance, and supports exposing simplified authorization endpoints for internal tooling.

Built-in Native Extensions and SQL Database Data Source

Provides pre-built native extensions distributed and supported by Cerbos requiring no custom development, including a native data source supporting SQLite, MySQL, PostgreSQL, and Litestream for database lookups.

Envoy External Authorization Extension

Implements the Envoy external authorization API natively to allow Envoy proxies to delegate authorization decisions to Synapse without a translation layer, working seamlessly with Envoy-based ingresses (such as Gloo, Contour, or Istio's filter chain) for edge or service mesh authorization, and supports configuring mapping from Envoy's CheckRequest to Cerbos requests declaratively or programmatically on Synapse rather than in Envoy.