Cedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization (Extended Version)
Joseph W. Cutler, Craig Disselkoen, Aaron Eline, Shaobo He, Kyle, Headley, Michael Hicks, Kesha Hietala, Eleftherios Ioannidis, John Kastner,, Anwar Mamat, Darin McAdams, Matt McCutchen, Neha Rungta, Emina Torlak, Andrew, Wells

TL;DR
Cedar is a new authorization language that offers an ergonomic, fast, safe, and analyzable way to define access policies, with formal verification and open-source implementation.
Contribution
It introduces Cedar, a novel authorization language with a focus on readability, performance, safety, and formal analysis, modeled and verified using Lean.
Findings
Cedar policies are more readable than comparable languages.
Cedar's evaluation engine performs significantly faster.
Formal properties of Cedar are proven using Lean.
Abstract
Cedar is a new authorization policy language designed to be ergonomic, fast, safe, and analyzable. Rather than embed authorization logic in an application's code, developers can write that logic as Cedar policies and delegate access decisions to Cedar's evaluation engine. Cedar's simple and intuitive syntax supports common authorization use-cases with readable policies, naturally leveraging concepts from role-based, attribute-based, and relation-based access control models. Cedar's policy structure enables access requests to be decided quickly. Cedar's policy validator leverages optional typing to help policy writers avoid mistakes, but not get in their way. Cedar's design has been finely balanced to allow for a sound and complete logical encoding, which enables precise policy analysis, e.g., to ensure that when refactoring a set of policies, the authorized permissions do not change. We…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAccess Control and Trust
