8. Both SDKs call Cerbos over its HTTP JSON API
Go and TS use Cerbos's HTTP JSON API (/api/check/resources, /api/plan/resources, /_cerbos/health) with a per-call timeout (250 ms default) and one retry.
Decision
Go and TS use Cerbos's HTTP JSON API (/api/check/resources, /api/plan/resources, /_cerbos/health) with a per-call timeout (250 ms default) and one retry. The Go SDK depends only on the standard library, lib/pq and goccy/go-yaml.
Consequences
- No gRPC or protobuf dependency tree in products; the same JSON shapes in both SDKs and the conformance fixtures.
- Slightly more bytes per call than gRPC; irrelevant next to the network hop to a sidecar.
- A gRPC transport can be added behind the
Cerbosinterface if profiling ever shows a need.
7. No escalation; `access.delegation:any` for administrators
Granting or revoking needs the actor to cover every effective grant (global covers all; self needs self or global; prefix needs the same scope with the target inside the actor's path; set needs...
9. Route guards plus strict requirement tracking
Routes declare their permission (Guard.Require, @RequirePermission).