Cedar is an open source language for writing and enforcing authorization policies, letting an application express fine-grained permissions as policies and decide access requests by calling Cedar’s authorization engine. It supports role-, attribute- and relation-based access control, and its language specification is formalized in Lean with the Rust implementation tested differentially against it. Cedar was accepted to CNCF at the Sandbox maturity level on 8 October 2025. Latest release v4.14.0 (17 October 2026), Apache 2.0.
Cedar
Cedar moves authorization out of application code and into policies. A Cedar policy says which principal may take which action on which resource, under which conditions; the application asks Cedar’s engine to decide each request against the policy set and the entities involved, and policies can be validated against a schema before they are deployed.
- Expressive but bounded - The language targets common models — RBAC and ABAC, and per the CNCF project page relation-based access — while keeping a structure that can be indexed and evaluated with bounded latency.
- Analyzable - Cedar is designed for automated reasoning. The
cedar-policy-symccsymbolic compiler verifies properties of policies and returns concrete counterexamples. - Formally specified - The cedar-spec repository holds a Lean formalization of Cedar with proofs, and differential randomized testing between that model and the Rust production implementation.
- Implementation crates - The Rust workspace ships the
cedar-policycrate, a CLI, a language server, a WebAssembly build for JavaScript and TypeScript, and a formatter. - CNCF Sandbox - Accepted to CNCF on 8 October 2025 at the Sandbox maturity level. Apache 2.0.
Where it sits. Cedar is a policy language in the same space as the Rego language of Open Policy Agent, designed with analyzability as a first constraint. It decides what an authenticated caller may do; identity and tokens arrive from OAuth 2.0, OpenID Connect or SPIFFE, and the models it expresses include RBAC.
