The Cerbos PDP v0.57.0 release refines how the PDP behaves at scale. Query plans now carry attribute presence checks through to your data layer, full reloads of large policy stores keep serving traffic while the new rule table builds, and the Cerbos Hub audit log backend runs with less CPU, memory and disk. The PDP is also now built on Go 1.27.3. One change needs a look if you maintain your own query plan handler. Everything is listed in the v0.57.0 release notes.
Query plans now include a has operator for attribute presence checks
PlanResources turns your policies into a filter you apply in the data layer, so the list of resources a user sees lines up with what CheckResources returns for each one. Most policies use has() as a guard before comparing an attribute, as in has(R.attr.owner) && R.attr.owner == P.id. Databases rarely need a separate existence check on a column, so the planner continues to leave those guards out, and plans for policies written this way are unchanged.
For presence checks that stand on their own, such as a condition of has(R.attr.owner) or a DENY rule on !has(R.attr.owner), the planner now keeps the check in the plan as a has operator. Your data layer can then apply the same presence test that CheckResources applies.
{
"operator": "has",
"operands": [
{ "variable": "request.resource.attr.owner" }
]
}
If you use a query plan adapter or wrote your own handler, confirm it recognizes has before upgrading, since a handler that doesn't will reject plans that contain it. The query plan response section of the API docs covers the full filter structure, and our posts on adapters such as Drizzle ORM and Convex show where operators map to database queries.
Full reloads of large policy stores keep serving requests while they rebuild
Reloading a disk, git or blob store now builds the new rule table outside the lock, so the current rule table keeps answering requests until its replacement is ready. Because traffic is no longer waiting on the rebuild, full reloads now run without the policy loader timeout, the same as at start-up. Very large stores therefore always reload in full rather than being cut short by the two-second default. The timeout still applies to incremental updates of individual policies.
Combined with the confirmed store reloads added in v0.56.0, a reload you trigger from CI returns once the complete policy set is being served.
Cerbos Hub audit log backend uses less CPU, memory and disk
When Cerbos Hub is the audit log backend, the PDP keeps entries in a local store and syncs them to Hub in batches. Three changes make that sync lighter. Each batch is read in its own short transaction that closes before the upload starts, so the local database reclaims disk space and memory as it goes. The sync skips expired entries instead of scanning them, which cuts CPU use on busy PDPs. Most sync cycles also pick up right after the last uploaded entry rather than walking every previously synced marker.
No configuration changes are needed. These are the same entries you view in Hub and send out through audit log exports, and the audit logs page covers how decision logging works across the platform.
Cerbos PDP is now built on Go 1.27.3
The PDP is now built with Go 1.27.3. That Go release includes a patch to distrust recently published insecure CA trust roots, even on hosts where the operating system's trust store hasn't been updated yet, so the PDP picks up that protection without waiting for a base image update.
Smaller fixes for specific policy combinations
Two fixes cover narrow combinations of policy types. The query planner now handles a principal policy ALLOW correctly when the matching resource policy has only DENY rules for that role and action, so the plan's filter matches CheckResources for that combination. And when several role policy or principal policy rules match overlapping resource names, each rule now evaluates its own condition rather than sharing a cached result, which keeps decisions consistent across those rules.
Breaking changes and upgrade notes for v0.57.0
Two changes are marked breaking. The has operator in query plans is the one to act on. Before rolling out v0.57.0, check that your query plan adapter or custom handler supports has, and compare PlanResources output in staging for any policy that uses has() outside a guard on the same attribute.
In role policies, allowActions now treats only * as a wildcard, matching the other policy types. It's marked breaking as a precaution, and we don't expect it to affect anyone. If you want to confirm, run your policy tests with cerbos compile against v0.57.0 before upgrading.
Upgrade to Cerbos PDP v0.57.0
v0.57.0 is available now. The release notes linked at the top cover every change in this release, and the v0.55.0 post and v0.54.0 post catch you up if you're coming from an older version.
Tagged in
