9 Implementing policies with Cedar
This chapter covers
- Designing and refining a Cedar schema as the foundation for policy authoring
- Writing core Cedar policies, including rules for ownership, viewers, managers, and teams
- Applying standard authorization patterns like discretionary, membership, and relationship permissions
- Enforcing global constraints and enhancing policies with templates and overrides
- Mapping real-world requests to Cedar evaluation and testing policies for correctness
At ACME Corp, the identity team has just finished deploying Cedar across the company’s Customer Collaboration platform. Chapter 7 provided the foundation: Cedar’s schema, syntax, and the PARC model for understanding policies. Now, it’s time to move from theory to practice.
ACME’s needs are varied. Engineers in the R&D group share design documents that must be editable only by their owners and managers. The legal department reviews contracts that should be visible to the entire legal team, but not to other employees. Account managers share marketing materials with customers, sometimes granting short-term access to external collaborators. And, in keeping with ACME’s zero-trust mandate, all access to critical resources must come from company-managed devices, with stricter constraints outside business hours.