Turn intent intopolicy you can prove.
cedrus is the typed control plane for Cedar authorization. Translate requirements into deterministic, verified, auditable policy bundles — without losing the thread between prose and production.
Authorization is the part of the stack
nobody wants to own.
Policies scattered across repos. Hand-written Cedar drifting from requirements. No review, no tests, no audit trail. One missed forbid and production is wide open.
Prose in the loop
When the LLM sees raw requirements, it also sees your instructions. Hostile text impersonates commands.
Silent drift
Generated policies drift from intent. Compilers reformat, validators accept, audits pass — until something breaks.
Deploys without proof
Bundles are pushed with no record of what shipped. Incidents take hours of archaeology to reconstruct.
From a one-line requirement
to a signed deploy.
Six stages. One typed intermediate representation. Every step is a gated transition — the verify pass is the contract that protects production.
A requirement Markdown with stable id and front matter.
The unit of governance. The contract that gates schema validation and the verify-domain pass.
hr/requirements/HR-042.mdA scope-typed proposal bound to a Need.
Principal, action, resource — typed up front. No regex, no string templating, no prose in the compiler.
Draft(id="hr-hr-042")The typed intermediate representation.
The single contract between every generator and the deterministic compiler. The compiler never sees prose.
Intent(...)Schema-validated, deterministic source.
Intent.compile() is the only code that emits Cedar. Calling it twice with the same intent produces identical source.
permit(principal, action, resource);AST-based static checks.
Flags shadowed forbids, redundant duplicates, missing coverage, malformed Cedar. Exact-signature match only.
Verifier(schema).verify(...)SHA-256-signed bundles, DNS-pinned HTTP.
Atomic writes, SSRF guard rejects loopback and RFC1918. Audit row records body_sha256, idempotency_key, retry_count.
Client.push(bundle)Engineered for the
boring parts that matter.
Every primitive exists because something in production went wrong without it. The compiler is the source of truth — not the prompt, not the prose, not the human.
A typed intermediate representation.
Intent is the single contract between every generator and the deterministic compiler. The compiler never sees prose — only typed scopes.
Deterministic Cedar compiler.
Intent.compile() is the only code that emits Cedar syntax. Same intent in, byte-identical source out. Schema-validated before persistence.
Static symbolic verifier.
Verifier(schema).verify() flags shadowing, redundancy, missing action / need / entity-type coverage, and malformed Cedar. No silent failures.
SSRF-safe deployer.
Every HTTP target is checked against loopback, link-local, and RFC1918 by Guard.check(url). DNS is resolved once and pinned for the connection's lifetime.
Tamper-evident audit chain.
Every state transition is recorded in the deployments table. body_sha256, idempotency_key, and retry_count travel with the row.
Prompt-fenced LLM.
User-controlled content is wrapped in <<<…>>> markers with a data-only preamble. Hostile requirement text cannot impersonate instructions.
A typed authorization compiler with deterministic Cedar output, static verification, and auditable deployment bundles.
The public package and command-line workflow share the same typed contracts and validation gates.
Intent.compile() is the only code that emits Cedar. Calling it twice with the same intent produces identical source.
Every deploy records the audit row. SHA-256 detects corruption; HMAC / Ed25519 is recommended for tamper evidence.
CLI and Python API.
One-to-one parity.
Every subcommand has a one-to-one equivalent in the public Python namespace. Use whichever fits your team's shape — both speak the same underlying protocol.
cedarpy, httpx, litellm.Production teams ship with cedrus.
The same pipeline that handles a single domain scales to a hundred — gated, versioned, auditable. No spreadsheets, no shared drives.
Enterprise authorization
Versioned, reviewable Cedar policies gated through CI. Every policy is a typed, addressable object.
Multi-team governance
Domain-scoped workspaces, per-domain schemas, and a verify-domain pass before any deploy is allowed.
Regulated industries
Auditable deploys with idempotency keys, retry counts, and SHA-256 bundle integrity. Built for compliance review.
Domain workspaces in production
Cedar, versioned.
For real this time.
Install cedrus, declare your domain, write one requirement, and ship a signed bundle before lunch. The compiler does the rest.