Repository navigation
docs(rfc): propose Cedar as an alternate sandbox policy language - #4564
Open
vishwa-raman wants to merge 7 commits into
Open
vishwa-raman wants to merge 7 commits into
vishwa-raman wants to merge 7 commits into
Conversation
RFC 0020 proposes authoring sandbox policies in Cedar as an alternative to YAML, chosen once per sandbox and enforced by Cedar alone. It is written for authors who use YAML today: what changes, how each YAML construct maps to Cedar with a translation tutorial, the architectural decisions behind the implementation, parity with the YAML engine, risks, alternatives, and the open questions to settle before acceptance. Refs #4411 Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
|
All contributors have signed the DCO ✍️ ✅ |
Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
6 tasks done
Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
Collaborator
Author
|
I have read the DCO document and I hereby sign the DCO. |
…estion Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
Collaborator
Author
|
/ok to test 9f80540 |
Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
Collaborator
Author
|
/ok to test fbca5f1 |
Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
Collaborator
Author
|
/ok to test 6b81504 |
Update RFC 0020 for the changes made in response to the pull request review: capability negotiation between clients, gateway, and runtime; staged policies isolated from enforced decisions and the query budget; bounded host selectors and overlap analysis; a sandbox-wide WebSocket budget; Cedar MCP endpoints in endpoint status; and the public skills. Refresh the implementation plan, verification results, parity tally, and risks, and list the proposed pull request split as a decision. Refs #4474 Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
Collaborator
Author
|
/ok to test f57a08f |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RFC 0020 proposes authoring sandbox policies in Cedar as an alternative to YAML. The format is chosen once per sandbox; YAML sandboxes are unchanged, and a Cedar sandbox is decided by Cedar alone, with no YAML or Rego in its decision path. The motivation is expressiveness that stays analyzable: authors can write conditions the YAML structure never anticipated, and every policy remains open to decidable analysis.
The RFC is written for policy authors who use YAML today. It covers what changes for an author, how each YAML construct maps to Cedar with a translation tutorial, the architectural decisions behind the implementation, parity with the YAML engine, risks, alternatives, and the open questions to settle before acceptance.
Related Issue
Closes #4610
Refs #4474, the parent issue for all policy work, which stays open, and #4411, the originating feature request where maintainers assigned RFC 0020.
Changes
rfc/0020-cedar-policy-engine/README.mdinreviewstate.Implementation
An implementation exists on the feature branch
vishwa/cedar-openshell(one commit onmain). The parity harness there runs 2,909 cases pairing YAML and Cedar policies through both engines; 2,904 agree and the 5 recorded differences are deliberate, with Cedar the stricter side in each. The branch depends on the Cedar team's delimitedlikework (cedar-policy/rfcs#115), carried in the publicai-openshell/cedarrepository and pinned by commit until Cedar releases it.Testing
mise run pre-commit; documentation-only change)Checklist
🤖 Generated with Claude Code