A Cedar Local Agent (CLA) is an open-source Rust component that keeps Cedar policies and entities in a customizable local cache. A policy enforcement point (PEP) can call it over HTTP before forwarding protected operations to application logic. section 9.8
This arrangement suits services that need low-latency, fine-grained authorization without depending on a public cloud. The operational tradeoff is local responsibility for deployment, scaling, updates, and policy or entity distribution. section 9.8 section 11.1.5
A local agent is useful when:
- A performance-sensitive service needs authorization without an additional remote network hop. section 11.1.5
- An organization needs control over Cedar policy and entity lifecycles across environments. section 9.8
- A service combines baseline network restrictions with resource-level Cedar decisions. section 11.1.5
Translating a document-sharing request
A PEP can turn a share request into an evaluation containing an employee principal, document-share action, document resource, and context such as managed-device status and request time. Cedar returns the authorization decision, which the PEP enforces before the backend runs. section 9.8
Figure 9.2 The Policy Enforcement Point (PEP) in ACME’s Customer Collaboration platform translates a real-world /share request into a Cedar evaluation by combining session data (principal), entity data (resource relationships), and context signals (environment attributes). Cedar’s is_authorized API provides an allow or deny decision, which the PEP enforces before forwarding the request to the backend.
Trace how session data, entity relationships, and environmental context become a Cedar decision enforced at the application boundary. section 9.8
