Cerbos Synapse is an authorization gateway and enrichment component designed to provide real-time context for authorization decisions by retrieving identity, resource, and relationship data from external systems at request time. It intercepts and processes Cerbos authorization requests through multiple extension points—Proxy extensions, Route extensions, Envoy extension, and Data sources—which enable attribute enrichment, response modification, custom HTTP endpoints for non-Cerbos protocols, and reusable lookup functions. Proxy extensions operate as a priority-ordered pipeline that can add, modify, or redact data before the policy decision point evaluates the request, while Route extensions expose custom endpoints that translate external authorization calls into Cerbos decisions. The Envoy extension implements the Envoy external authorization API for direct delegation of edge or service-mesh traffic, and Data sources provide named integrations with databases, APIs, or other services.
Synapse integrates with identity providers including Okta, Entra ID, Cognito, and LDAP to fetch user profiles, groups, and attributes, and supports infrastructure integrations with API gateways, messaging queues, data platforms, and deployment pipelines. It can retrieve attributes from SQL databases, graph stores, and internal APIs, and supports custom data sources and protocol adapters built in any language compiling to WebAssembly. Extensions support multiple implementation runtimes including native built-in components, declarative CEL mappings, Starlark scripts, and WebAssembly modules compiled from languages such as Go, Java, Python, or TypeScript/JavaScript. Synapse connects enforcement points through existing infrastructure protocols, translating them into Cerbos policy checks without requiring custom middleware or policy enforcement point code. Access to the Cerbos distribution registry for Synapse updates is authenticated using a distribution license key with configurable rotation and revocation capabilities.
