Cedar: the access control building block that's perfectly timed for AI agents

One complexity for identity and access management is that every application has its own granular access control system; every developer has to deal with it and admins have to learn all of them. Providers like AWS have the same issue in spades, @estesp.dev says, which is why they came up with Cedar

At Kubecon this year @bridgetkromhout.bsky.social sent me to talk to @luxas.dev about a new CNCF project around policy management, donated by AWS: Cedar is both a language for writing policies and a formally verified engine you can drop into your application to do RBAC and ABAC and also audit policy

Formally verified sounds scary but in practice, Cedar policies are easy for humans to read as well as easy for the engine to verify and the engine is so easy to work with, @jaosorior.dev added it to @stacklok.com Toolhive in about a day; Cloudflare, MongoDB and others have already adopted it too

@luxas.dev and @estesp.dev both see Cedar offering a lot to Kubernetes, which has RBAC but not nearly enough granularity; it's also extremely well timed for AI agents, where you really want to have clear policies about what they can do that don't have loopholes so they can't find clever ways around.

AWS definitely participates in open source, but not always in particularly visible or consistent ways; Cedar was designed for open governance, open sourced early on and has a strong community helping it evolve, so maybe it will be the project that makes AWS participation more visible and robust.

also, come for the details of Cedar, stay for @jaosorior.dev having the exact same reaction to the 'security' features in MCP that I did when I first came across it.