Skip to main content
Cedarling

Keep every action within policy.

Cedarling is an embeddable authorization engine for applications and AI agents. It evaluates Cedar policies close to the action using either JWTs from trusted issuers or identity and context established by your application, then returns an ALLOW or DENY decision with diagnostics.

Try Cedarling in the PlaygroundSee how Cedarling works
Cedarling evaluates Cedar policies using either signed tokens from trusted issuers or facts asserted by the application.

AI agents can act in seconds. Keep policy in the path.

Cedarling lets your application check whether an agent may use a tool, read data, or change a workflow before execution.

An AI agent surrounded by policy, data, security, audit, and operational controls.

Control tool use

Decide whether an agent may call a tool or perform an operation before execution.

Use one policy language

Apply Cedar policies across agents, users, services, and environments.

Keep enforcement close

Embed Cedarling in-process or place it beside the service that owns the protected action.

One authorization question, four Cedar inputs.

Can this principal perform this action on this resource in this context?

In token-based authorization, Cedarling validates one or more mapped JWTs and makes their claims available to Cedar policies.

In application-asserted authorization, your application supplies the principal and is responsible for establishing its identity.

Principal

Example

  • user: 123
  • role: developer
  • team: payments

Action

Example

  • action: "view"
  • object: "report"
  • tool: "read"

Resource

Example

  • type: "report"
  • id: "hr-789"
  • owner: "acct-1"

Context

Example

  • ip: "203.0.113.17"
  • time: "2026-05-01"
  • env: "production"
ALLOWWhen authorized
DENYWhen not allowed

Bring policy to the enforcement point.

Use Cedarling in an application process or alongside it, from browser and mobile experiences to backend services, API gateways, databases, and sidecars.

Connected application, service, gateway, database, and device environments where Cedarling can evaluate policy.

One policy model. Your stack.

Bring Cedarling into JavaScript, Python, Rust, Go, Java, Kotlin, Swift, C, mobile applications, gateways, databases, or a language-independent sidecar.

Explore supported environmentsExplore the ecosystem
JavaScript
Python
Rust
Kotlin
Swift
Go
Java
C
Browser
iOS
Android
API gateway
Cedarling Sidecar

See Cedarling make a real decision.

Open a reviewed policy store, change a safe request, and run Cedarling locally in your browser.

Most Playground samples call authorizeUnsigned with application-asserted identity. Google Trusted Identity calls authorizeMultiIssuer with an ID token from a configured trusted issuer.

Open the PlaygroundRead What is Cedarling?