1. Cerbos evaluates generated policies; grants travel as principal attributes

Context

Products need scoped RBAC (team, org unit, own records) with record-level conditions, list filtering in SQL, and roles admins edit at runtime. Hand-written policies per product drift, and per-tenant policies multiply.

Decision

Cerbos PDP (Apache 2.0, pinned to 0.57.0) runs as a sidecar. zaccess gen turns manifests into one static resource policy per kind: same org AND permission held AND any allowed scope matches AND the action's condition. Rules use roles: ["*"]; who holds what is sent on every request as principal attributes (perms), computed from Postgres. Schemas are generated and enforced with reject.

Consequences

• Policies only change when code changes, so they are reviewed and tested like code (zaccess test).
• Admins change access without deploys; changes apply within the cache TTL or immediately via NOTIFY.
• Every scope key must always be present in perms, or query plans keep unresolved residuals. GrantJSON guarantees it.
• PlanResources gives list filters for free (see ADR 5).