A hybrid deployment runs Cedar authorization evaluation locally while remotely storing and managing policies and entities. The local evaluator delivers low-latency decisions; the managed service remains the primary source of truth and periodically synchronizes updates. section 9.8
This pattern combines operational convenience with local control:
- Local evaluation avoids depending on network latency for every authorization decision. section 9.8
- Managed policy hosting supplies centralized maintenance, while synchronized local data supports on-premises deployments. section 9.8
- The same Cedar policy code can support different deployment locations and evaluation paths. section 9.8
ACME Customer Collaboration
ACME uses Cedar Local Agent for low-latency, on-premises deployments and Amazon Verified Permissions (AVP) for customer-facing software hosted entirely in AWS. Policies remain consistent while evaluation location changes. section 9.8
