[#quote#]

[#graysection#]

[#cerboshubctabanner#]

[#video#]

# Introduction

## “The mechanism used to package features is not a core competency.” 

9fin’s engineering team was familiar with the potential hazards involved with building permission systems. They had a good idea of what they didn’t want to happen. **Managing home-built access controls can become a significant drain on time and mental bandwidth. And it can pull focus away from core features that drive business value.** 

From their perspective, the mechanism used to package features is not a core competency. The actual features being packaged by that mechanism are what drive business value and deserve their full focus. So looking outside for an access control solution was an obvious choice. 

However, there is a “Goldilocks zone” of compatibility when it comes to implementing outside frameworks. The solution can’t be too structured that it doesn’t fit into the existing software, but if it’s not structured enough it doesn’t add much value. “Frameworks that aren’t opinionated at all tend to lead to chaos,” says Joe Qureshi, Senior Software Engineer at 9fin, “And the ones that are tend to run into the ‘unsupported pattern’ problem quickly.”

An access control system that fits in the Goldilocks zone would be structured enough to remove the burden of having to build and maintain the logic as code, but flexible enough to integrate seamlessly into their existing architecture.
 
<a href="https://cerbos.dev/features-benefits-and-use-cases/product-packaging">Learn more about the product packaging use case for Cerbos</a>
 

# Requirements

## Fine-grained, clearly codified, and strictly controlled 

The mechanism to control product packaging may not be a core competency to 9fin engineers, but it is a core security requirement. **As a fintech platform, one of 9fin’s chief concerns is compliance.** So the mechanism that controls who accesses which resources needs to be clearly codified, strictly controlled, and auditable. 

Next, **they need to be able to change or customize features and product packaging easily, without compromising their strict security standards.** 9fin serves 9 out of 10 of the top investment banks, and some of the world’s most prestigious law firms, which have some overlapping needs and some needs that are specific to their business type. In some special cases, they may want to override permissions for a particular feature or create policies that account for multiple conditions required to access resources and subsets of resources. 

 
[#graysection#]

[#quote#]


# Results

## Progressive complexity for feature packaging with minimal time commitment

Joe implemented simple policies with Cerbos at first, and was happy about how quickly he was able to make it useful to the product. **“There was a very low bar to get going and start shipping,” he says, “Cerbos has a pattern of having a single microservice so that we could gradually roll out the rules to other services beyond the main web app.”**

As Joe began adding more complex policies and editing product packaging, he found the process to be clear-cut and simple. **Changing product packages took him 10 minutes, when he would have otherwise expected it to take hours.** 

“The way Cerbos policies are designed allows us to keep adding rules, without bloating and creating spaghetti code,” he explains. “I can quickly and confidently change rules on policies. And I struggle to think of requirements that can’t be expressed in the policy format Cerbos has developed”

As a bonus, Joe shares that using Cerbos has helped the business side and product side teams communicate more effectively. “It helped form a language to illustrate requirement complexity to the non-technical stakeholders of projects,” he says. 

The mechanism to control feature packaging may not be a core competency, but since using Cerbos, it’s something they can do really well without having to spend too much time on it. Plus, **having the freedom and flexibility to change and customize product packaging means that 9fin can get features to market faster** and respond to client requests faster. All they need is 10 minutes. And then they go back to building new features and growing the business. 


 
[#quote#]

### Related links
* <a href="https://www.cerbos.dev/customers/human-managed">Human Managed creates a future-proof ABAC engine</a>
* <a href="https://www.cerbos.dev/customers/debite">Debite accelerates compliance certification and ships products faster</a>
### Learn more about Cerbos
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/product-packaging">Product packaging with Cerbos</a>
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/ecosystem">Ecosystem</a>
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/human-readable-authorization">Human-readable authorization</a>
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/decoupled-authorization">Decoupled authorization</a>
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/flexible-deployment-models">Flexible deployment with low-latency</a>

Reduced hours of developer time to 10 minutes

Eliminated technical debt from authorization

Accelerated feature development and time to market

A finance data platform serving top 10 investment firms reclaims their time, prevents future technical debt, and gets features to market faster by implementing authorization rules with Cerbos.

Customer success story: 9fin modifies product packaging in 10 minutes with Cerbos

9fin

We can keep adding rules, without bloating and creating spaghetti code. I struggle to think of requirements that can’t be expressed in the Cerbos policy format.

The fact that Cerbos is open source and therefore isn’t a black box is great. We write and maintain policies in our repositories so we retain a sense of ownership.

There was a very low bar to get going and start shipping. Cerbos has a pattern of having a single microservice so that we could gradually roll out the rules to other services beyond the main web app.

Success story

9fin modifies product packaging in 10 minutes

Case Study