Your policy store
Open a new sandbox
Build a browser-local draft from the schema, policies, entities, and request facts you provide.
Open new sandboxPlayground
Play with examples
Explore how Cedarling evaluates sample requests against the Cedar policies in a policy store, right in your browser. Choose an example, read its README, then change the request facts or policies and compare ALLOW and DENY results.
Each README explains the example, its architecture, and what its policies demonstrate. The Playground evaluates requests; it does not perform the example's protected actions.
Identity in these samples
Most samples focus on Cedar policy behavior using application-established identity and run without an account. The Google Trusted Identity sample adds one real signed ID token so you can inspect Cedarling's trusted-issuer flow in the same browser workbench.
Google Trusted Identity
Validate one Google ID token and authorize simulated documents from its signed subject claims.
Decision focus: trusted issuer · ID token claims · resource ownership
Outcome scope: 4 request cases using one signed ID token.
Signed identity
OpenClaw Tool Firewall
Check whether an AI agent may browse, read, write, run commands, or deploy before the tool executes.
Decision focus: default deny · tool clearance · production approval
Outcome scope: 5 request cases across 5 principals.
OpenClaw logo © OpenClaw Foundation, used under the MIT License. No endorsement is implied.
Coding Agent Worktree Guard
Keep coding-agent reads, edits, commands, and pushes inside approved repository boundaries.
Decision focus: workspace boundary · change risk · production approval
Outcome scope: 5 request cases across 5 principals.
Email and Calendar Agent Guard
Check delegated email and calendar actions before messages are sent or events change.
Decision focus: delegation · send boundary · calendar changes
Outcome scope: 5 request cases across 5 principals.
Multitenant Commerce SaaS
Keep catalog, order, refund, pricing, and export actions inside tenant boundaries.
Decision focus: tenant isolation · refund approval · pricing risk
Outcome scope: 5 request cases across 5 principals.
HR SaaS Employee Records
Protect employee records with tenant, sensitivity, and approval boundaries.
Decision focus: employee privacy · sensitivity · manager approval
Outcome scope: 5 request cases across 5 principals.
Secure File Sharing SaaS
Control file access, sharing links, revocation, downloads, and destructive changes.
Decision focus: file ownership · link sharing · revocation
Outcome scope: 5 request cases across 5 principals.
Multiplayer Game Rules
Control match access, item trades, moderation, and season-reset operations.
Decision focus: player state · item trade · moderation
Outcome scope: 5 request cases across 5 principals.
AI Skills Registry
Control who may discover, install, publish, approve, or remove agent skills.
Decision focus: skill provenance · installation · publication approval
Outcome scope: 5 request cases across 5 principals.
Pharmacy Operations and Prescriptions
Control prescription, inventory, override, transfer, and dispense-record operations.
Decision focus: prescription safety · inventory access · clinical override
Outcome scope: 5 request cases across 5 principals.
Patient Records and Care Teams
Model care-team access to fictional patient records, exports, and break-glass actions.
Decision focus: care-team membership · record sensitivity · break glass
Outcome scope: 5 request cases across 5 principals.
Workforce Resource Access and Onboarding
Control onboarding, resource assignment, access grants, vendor approval, and termination.
Decision focus: onboarding state · resource assignment · access grant
Outcome scope: 5 request cases across 5 principals.
Collaborative Document Editing
Control document viewing, comments, edits, publication, and deletion.
Decision focus: document ownership · commenting · publication
Outcome scope: 5 request cases across 5 principals.
Fintech Payments and Approvals
Separate payment creation, approval, fund release, and settlement reversal.
Decision focus: payment initiation · dual approval · fund release
Outcome scope: 5 request cases across 5 principals.
Education and Student Records
Protect fictional courses, grades, enrollment, transcripts, and student-record exports.
Decision focus: course access · grading · enrollment
Outcome scope: 5 request cases across 5 principals.
Customer Support and CRM
Limit ticket access, customer changes, credits, and data exports for support teams.
Decision focus: ticket scope · customer updates · credit approval
Outcome scope: 5 request cases across 5 principals.