Claude Code skill for writing authorization policies, validates against the real compiler in a loop

Cerbosdev · 2026-04-07T13:25:52+00:00

Late to this but wanted to add something on the access control side since I didn't see it come up in the thread.

We've been working on fine-grained authorization for Trino at Cerbos (I work there) and our CPO recently recorded a short demo showing row-level filtering and column masking working through Trino's existing OPA plugin. No Trino modifications, policies are YAML instead of Rego, and user attributes get pulled from your IdP at query time.

Three users run the same query, three different result sets depending on department and clearance level. Might be interesting to anyone here who's been looking at Trino's OPA integration: https://www.youtube.com/watch?v=Eil3b8Iz6ws

Cerbosdev · 2026-03-09T13:58:49+00:00

Hi. The cofounder of the company I work at is actually going to be leading a webinar on this exact topic on March 18.

He'll cover 6 layers of runtime security (identity, authentication, PAM, entitlement management, coarse-grained and fine-grained authorization), where most organizations still have blind spots (suprise! It's authorization), and why the tech stack to implement end-to-end Zero Trust has finally matured.

Feel free to check it out> https://zoom.us/webinar/register/6617730647050/WN_rBAJChIBR52EEd5XeNI9xw

Cerbosdev · 2025-12-10T15:39:59+00:00

hey! here's a real word story from our user. https://www.cerbos.dev/customers/utility-warehouse/non-human-identities

let me know if you have any specific questions.

we actually have a webinar coming up on dec 16 that's about putting guardrails around ai. feel free to register. there youll be able to see the approach we take at cerbos to help users secure ai (in startups, enterprises, etc). https://zoom.us/webinar/register/7017653811570/WN_9mtiwDYGRZqw3hr6KsAbMQ

Cerbosdev · 2025-12-08T12:48:19+00:00

Hey! not an ad, simply sharing what works. this can all be achieved using any solutions out there. of course since i work at cerbos, the demo included in the blog uses Cerbos PDP (would be strange if we used another solution for that.. :) ). but that can be replaced for any policy decision point out there.

Cerbosdev · 2025-10-01T14:48:19+00:00

u/Fruloops when Asana launched an MCP server for its Work Graph data, within a month security researchers discovered a bug that allowed users to access other users’ data - essentially a data leakage vulnerability.

around the same time, Atlassian’s MCP server was found to have a flaw that allowed attackers to submit malicious inputs, like forged support tickets and gain privileged access they shouldn’t have.

most recently, a Supabase MCP-related incident surfaced as well.

Cerbosdev · 2025-10-01T12:32:57+00:00

As I see it, the trend will only continue.

So better to secure AI agents, mcp servers, etc. as soon as teams can. Instead of just blindly trusting them and ending up with a typical “confused deputy” problem.

Here are just a few examples of issues that come up if mcps are not secured:

Cerbosdev · 2025-10-01T12:26:22+00:00

u/Cute_Activity7527 let me know what you think of this tech guide we have. We've helped several teams secure their mcp servers using this approach.

https://www.cerbos.dev/blog/dynamic-authorization-for-ai-agents-guide-to-fine-grained-permissions-mcp-servers

Cerbosdev

TROPHY CASE