Cerbos: Authorization Policies (RBAC/ABAC)

Plugin cerbos-skills from marketplace cerbos-skills in cerbos/skills. Commands read from the repo's manifest — today.

Skills (20)

• build-review-interface

  Build a custom browser-based annotation interface tailored to your data for reviewing LLM traces and collecting structured feedback. Use when you need to build an annotation tool, review traces, or collect human labels.

• create-task

  Create a new Harbor task for evaluating agents. Use when the user wants to

• error-discovery

  Run error analysis on a dataset. Build a review UI, select diverse samples, monitor annotations, and organize failure modes.

• eval-audit

  Audit an LLM eval pipeline and surface problems: missing error analysis, unvalidated judges, vanity metrics, etc. Use when inheriting an eval system, when unsure whether evals are trustworthy, or as a starting point when no eval infrastructure exists. Do NOT use when the goal is to build a new evalu

• evals-start

  Entry point for evals. Use when the user asks for help with evals, does not know where to begin, or asks for something no other skill in this plugin matches. Do NOT use when a more specific skill in this plugin already matches; load that skill directly.

• generate-synthetic-data

  Create diverse synthetic test inputs for LLM pipeline evaluation using dimension-based tuple generation. Use when bootstrapping an eval dataset, when real user data is sparse, or when stress-testing specific failure hypotheses. Do NOT use when you already have 100+ representative real traces (use st

• harbor-exec

  Use when working with Harbor's `harbor exec` CLI workflow: compiling files, directories, or globs into Harbor tasks; running map jobs; configuring artifacts and existence-only verification; using map-reduce; writing or reviewing ExecConfig YAML/JSON/TOML; or debugging command behavior, config valida

• rewardkit

  Write Harbor task verifiers using Reward Kit. Use when creating or editing a

• validate-evaluator

  Calibrate an LLM judge against human labels using data splits, TPR/TNR, and bias correction. Use after writing a judge prompt (write-judge-prompt) when you need to verify alignment before trusting its outputs. Do NOT use for code-based evaluators (those are deterministic; test with standard unit tes

• write-judge-prompt

  Design LLM-as-Judge evaluators for subjective criteria that code-based checks cannot handle. Use when a failure mode requires interpretation (tone, faithfulness, relevance, completeness). Do NOT use when the failure mode can be checked with code (regex, schema validation, execution tests). Do NOT us

• writing-for-agents

  Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.

• writing-great-skills

  Reference for writing and editing skills well — the vocabulary and principles that make a skill predictable.

• cerbos-audit-insights

  Cerbos audit logs and Cerbos Hub Insights. Use when enabling audit or decision logging, getting a PDP or Synapse instance to emit decisions at all, debugging an application that allows or denies the wrong thing, masking PII, tokens or headers before entries leave the network, or answering a complian

• cerbos-authz-migration

  Migrate an existing authorization implementation to Cerbos. Use when moving permission checks out of application code (scattered role checks, a `can()` helper, middleware guards, a database permissions table), when replacing another authorization system (OPA/Rego, Casbin, Oso, Pundit, SpiceDB, OpenF

• cerbos-embedded-pdp

  Embedded Cerbos PDP (ePDP) — authorization evaluated locally in WebAssembly by `@cerbos/embedded-client`, with no call to a PDP server. Use when showing or hiding UI by permission in a browser or React Native app, authorizing offline or inside an edge function, CDN worker, or serverless handler, con

• cerbos-hub-setup

  Stand up and operate Cerbos Hub — policy store, deployment, client credentials, and a PDP fetching signed bundles. Use when setting up Cerbos Hub for the first time, connecting or configuring a PDP against a Hub deployment, rolling back or freezing a deployment, monitoring connected PDPs, or diagnos

• cerbos-pep-integration

  Call a Cerbos PDP from application code — the policy enforcement point. Use when adding a permission check to a handler, filtering a query or list by permission (`planResources`, ORM adapters), passing JWT claims to the PDP, authorizing agent or MCP tool calls, or choosing an SDK for JavaScript, Go,

• cerbos-policy

  Generate, modify, and explain Cerbos authorization policies — resource and role policies, derived roles, exported variables, CEL conditions, and `*_test.yaml` suites. Use when writing access control rules from requirements or a spec document (including PDFs), changing what an existing policy allows,

• cerbos-synapse-extension

  Builds, scaffolds, tests, debugs, and troubleshoots Cerbos Synapse extensions — call mappers, data sources, proxy extensions, route extensions, Envoy ext_authz extensions — in declarative YAML/CEL, Starlark, or WASM (Go, TypeScript/extism-js, Python/extism-py). Covers principal enrichment, attribute

• cerbos

  Authorization design for Cerbos — which component solves an access-control need. Use whenever a user describes who may view, edit or approve which records, roles and permissions, per-tenant rules, filtering a list to the rows a user may see, gating an API gateway by user type, or authorizing agent o

Similar plugins