# Cedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization (Extended Version)

arXiv: https://arxiv.org/abs/2403.04651 · HTML: https://mlsanity.com/paper/2403.04651/

## Key facts

- Cited by 34 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Mar 2024.

## Built on by (most cited first, 30 of 34)

- [Progent: Securing AI Agents with Privilege Control](https://mlsanity.com/paper/2504.11703/) (2025)
- [VERINA: Benchmarking Verifiable Code Generation](https://mlsanity.com/paper/2505.23135/) (2025)
- [Enforcing Temporal Constraints for LLM Agents](https://mlsanity.com/paper/2512.23738/) (2025)
- [Formal Policy Enforcement for Real-World Agentic Systems](https://mlsanity.com/paper/2602.16708/) (2026)
- [Systems Security Foundations for Agentic Computing](https://mlsanity.com/paper/2512.01295/) (2025)
- [Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks](https://mlsanity.com/paper/2603.30016/) (2026)
- [VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills](https://mlsanity.com/paper/2606.26524/) (2026)
- [A Lean Dataset for International Math Olympiad: Small Steps towards Writing Math Proofs for Hard Problems](https://mlsanity.com/paper/2411.18872/) (2024)
- [Agent Security is a Systems Problem](https://mlsanity.com/paper/2605.18991/) (2026)
- [Deontic Policies for Runtime Governance of Agentic AI Systems](https://mlsanity.com/paper/2606.19464/) (2026)
- [Trustworthy Agentic AI Requires Deterministic Architectural Boundaries](https://mlsanity.com/paper/2602.09947/) (2026)
- [Verifiable Agentic Infrastructure: Proof-Derived Authorization for Sovereign AI Systems](https://mlsanity.com/paper/2605.15228/) (2026)
- [Theory-Level Autoformalization: From Isolated Statements to Unified Formal Knowledge Bases](https://mlsanity.com/paper/2607.13292/) (2026)
- [AutoCedar: An Agentic Framework for Verifier-Guided Access Control Policy Synthesis](https://mlsanity.com/paper/2607.03656/) (2026)
- [AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems](https://mlsanity.com/paper/2608.22868/) (2026)
- [MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents](https://mlsanity.com/paper/2512.11147/) (2025)
- [Prose2Policy (P2P): A Practical LLM Pipeline for Translating Natural-Language Access Policies into Executable Rego](https://mlsanity.com/paper/2603.15799/) (2026)
- [Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents](https://mlsanity.com/paper/2604.24686/) (2026)
- [Alignment Contracts for Agentic Security Systems](https://mlsanity.com/paper/2605.00081/) (2026)
- [Automating Formal Verification with Reinforcement Learning and Recursive Inference](https://mlsanity.com/paper/2605.30914/) (2026)
- [Behavioral Governance for Autonomous AI Agents: The AgentBound Framework](https://mlsanity.com/paper/2606.30970/) (2026)
- [Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound](https://mlsanity.com/paper/2609.05920/) (2026)
- [Execution Envelopes: A Shared Admission Contract for Backend AI Execution Requests](https://mlsanity.com/paper/2605.08267/) (2026)
- [KYA: A Framework-Agnostic Trust Layer for Autonomous Systems with Verifiable Provenance and Hierarchical Policy Composition](https://mlsanity.com/paper/2605.25376/) (2026)
- [Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems](https://mlsanity.com/paper/2606.26298/) (2026)
- [Stateful Governance for Concurrent Agentic Systems](https://mlsanity.com/paper/2608.02764/) (2026)
- [AEGIS: Preventing Cross-Domain Resource Abuse in MCP](https://mlsanity.com/paper/2608.20481/) (2026)
- [Five Primitives for Governing Autonomous AI Agents at Runtime](https://mlsanity.com/paper/2608.26696/) (2026)
- [If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary](https://mlsanity.com/paper/2608.27646/) (2026)
- [Structured Decomposition for Reliable LLM-Generated Access Control Policies](https://mlsanity.com/paper/2609.24036/) (2026)

## Abstract (arXiv)

Cedar is a new authorization policy language designed to be ergonomic, fast, safe, and analyzable. Rather than embed authorization logic in an application's code, developers can write that logic as Cedar policies and delegate access decisions to Cedar's evaluation engine. Cedar's simple and intuitive syntax supports common authorization use-cases with readable policies, naturally leveraging concepts from role-based, attribute-based, and relation-based access control models. Cedar's policy structure enables access requests to be decided quickly. Cedar's policy validator leverages optional typing to help policy writers avoid mistakes, but not get in their way. Cedar's design has been finely balanced to allow for a sound and complete logical encoding, which enables precise policy analysis, e.g., to ensure that when refactoring a set of policies, the authorized permissions do not change. We have modeled Cedar in the Lean programming language, and used Lean's proof assistant to prove important properties of Cedar's design. We have implemented Cedar in Rust, and released it open-source. Comparing Cedar to two open-source languages, OpenFGA and Rego, we find (subjectively) that Cedar has equally or more readable policies, but (objectively) performs far better.