Production authorization, built around Cedarling.
Combine Cedarling’s policy decisions with application enforcement, trusted identity, controlled policy releases and centralized decision logs. Integrate these components with your existing infrastructure.
Jans Auth or trusted OIDC issuerSigned token evidence
Agama Lab Policy Designer
Git releaseVersioned .cjar policy store
Cedarling inside the applicationALLOW or DENY → protected operation
Janssen Lock ServerDecision, system, and metric logs
Enforcement
Application enforcement with Cedarling
Separate authorization rules from application logic while keeping enforcement at the protected operation. Cedarling evaluates requests against policies; your application or gateway permits or blocks access.
Cedarling integration documentation (opens in a new tab)Cedarling- Your application or gateway
Policy Enforcement Point
Owns protected operations, trusted resource data and request context.
- Cedarling
Policy Decision Point
Evaluates authorization requests against the loaded policies and returns an allow or deny decision.
Embed Cedarling in the application process or deploy it as a sidecar. Define how the enforcement point handles denied requests, evaluation errors and unavailable decisions.
Identity
Trusted identity with Jans Auth or your existing provider
Use identity evidence from configured trusted issuers in authorization decisions. Jans Auth can provide authentication and token issuance; Cedarling validates configured tokens and makes their claims available to policies.
Trusted issuer and token validation documentation (opens in a new tab)Jans AuthCedarling- Jans Auth or your trusted issuer
Identity and token issuance
Supplies signed claims and issuer metadata under your identity configuration.
- Cedarling token validation
Evidence for policy evaluation
Validates mapped tokens against configured trust and claim requirements.
Applications that establish identity themselves can supply application-asserted principals through their trusted enforcement boundary.
Policies
Policy governance with Agama Lab and Git
Author and test authorization policies in Agama Lab Policy Designer. Review changes in Git and release versioned policy stores for deployment to Cedarling.
Agama Lab policy release documentation (opens in a new tab)Agama LabGitCedarling- Agama Lab Policy Designer
Policy authoring and testing
Maintains the schema, policies and test requests for review.
- Your Git and release workflow
Versioned policy delivery
Records reviewed changes and publishes versioned policy-store artifacts.
Keep policy authoring and release management separate from runtime evaluation, with a traceable record of the policy version deployed.
Audit
Centralized decision logging with Lock Server
Collect Cedarling decision logs across applications with Janssen Lock Server. Use allowed and denied decisions to investigate access, understand policy behavior and support audit reviews.
Lock Server integration documentation (opens in a new tab)CedarlingLock Server- Cedarling decision logs
Authorization evidence
Captures evaluation outcomes and policy diagnostics.
- Janssen Lock Server
Optional centralized collection
Centralizes collection from multiple Cedarling instances using authenticated connections.
Configure authenticated log delivery, retention and access controls to meet your operational requirements.
Responsibility map
Keep every boundary explicit.
A production deployment assigns one owner to each authorization responsibility. Components can change; the boundaries must remain clear.
| Responsibility | Typical owner |
|---|---|
| Authenticate users and issue tokens | Jans Auth or another trusted issuer |
| Author and test Cedar policies | Agama Lab Policy Designer |
| Review and release policy stores | Your Git and release workflow |
| Evaluate authorization requests | Cedarling |
| Enforce ALLOW or DENY | Your application, API, gateway, or service |
| Collect decision logs | Lock Server or your protected log pipeline |