cerbos-sqlalchemy

What it is and what it does

cerbos-sqlalchemy bridges Cerbos, an open-source authorization engine, and SQLAlchemy by translating Cerbos query plans (from its PlanResources API) into native SQLAlchemy Select queries. Instead of fetching all records and filtering in application code, this adapter pushes authorization logic down to the database layer, where the SQL WHERE clause enforces attribute-based access control rules.

The adapter handles logical operators, comparisons, field-to-field checks, string operations, timestamps, and hierarchy comparisons. It is tested against Cerbos PDP 0.54.0 with 112 reference conformance actions and supports both ORM entities and raw Table instances. Users can override default SQL operators for database-specific optimizations (e.g., PostgreSQL's `= ANY` instead of `IN`), and must ensure mapped columns use case-sensitive collation to prevent silent over-granting of access.

Use it for:

• Enforce department-level access control on leave requests by converting Cerbos policies into WHERE clauses that filter authorized rows.
• Implement role-based filtering on multi-tenant data by translating principal attributes and resource policies into database queries.
• Optimize authorization checks on large datasets by pushing policy evaluation to the database query layer instead of loading in memory.
• Support complex attribute-based rules (e.g., geography, team, priority) by mapping Cerbos CEL expressions to portable SQL predicates.
• Override default SQL operators for database-specific idioms, such as using PostgreSQL's `= ANY` for collection membership instead of `IN`.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Converts Cerbos authorization query plans into SQLAlchemy Select queries, enabling attribute-based access control enforcement directly in database queries.

Yes. This is a well-maintained, low-friction adapter (pure Python, two dependencies, no vulnerabilities) that solves a real problem: pushing authorization enforcement into database queries rather than application code. It is actively developed, permissively licensed, and tested against a reference conformance suite. Install it if you use Cerbos and SQLAlchemy together and want to avoid loading unauthorized records into memory.

Install

cerbos-sqlalchemy on PyPI

pip install cerbos-sqlalchemy

uv add cerbos-sqlalchemy

poetry add cerbos-sqlalchemy

Installing cerbos-sqlalchemy

Before you install

Low friction: pure Python wheel with only two runtime dependencies (cerbos and sqlalchemy). Active maintenance with a recent release (11 days old) and no known vulnerabilities.

License in practice

Apache-2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.

Quickstart

pip install cerbos-sqlalchemy

from cerbos.sdk.client import CerbosClient
from cerbos_sqlalchemy import get_query
from sqlalchemy.orm import declarative_base

Base = declarative_base()
class LeaveRequest(Base):
    __tablename__ = "leave_request"
    # ... columns ...

with CerbosClient(host="http://localhost:3592") as c:
    plan = c.plan_resources("view", principal, resource_desc)

attr_map = {"request.resource.attr.department": LeaveRequest.department}
query = get_query(plan, LeaveRequest, attr_map)

Requires a running Cerbos PDP server (typically at localhost:3592 or configured host); SQLAlchemy >= 1.4 and Cerbos > v0.16.

Verify before relying

• Exact scope of CEL operator coverage beyond the 112 reference conformance actions listed.
• Performance characteristics when translating complex query plans with many nested conditions.
• Compatibility with SQLAlchemy 2.0 ORM features beyond the basic declarative patterns shown.

Package facts

Evidence: cerbos_sqlalchemy-0.4.0-py3-none-any.whl

Tags

More Libraries packages