[#quote#]

[#graysection#]
[#cerboshubctabanner#]
[#video#]

# Introduction

## An in-house authorization system due for an overhaul

When you are an FTSE 250 company with a team of 200+ engineers running over 4,500 services, the idea of re-building your in-house authorization system can be highly daunting. For Rob Crowe, the Principal Engineer at Utility Warehouse, it was clear that such a re-build was due. Utility Warehouse’s internal authorization logic was ‘long in the tooth’. Rob knew that there would be trouble down the road if his team didn’t upgrade the system.  

**“We’d built an internal authorization software but we hadn’t looked after it. It kind of worked but it was basic and a bit cumbersome,”** he explained. Utility Warehouse had YAML files in a GitHub repository that defined their role-based access control (RBAC) policies. But with 4,500 internal services, managing changes was getting hairy. 

“The JWTs were too big to fit in browsers and cookies, so we had to hack around it,” Rob recounts, “We realized that our 200+ engineers were doing their own thing, we didn’t have a standard way of doing authorization, and we had no way of testing our pull requests. If we thought it looked right, we merged it and waited to see if it worked.”

As a result of code bloat, lack of standardization, and insufficient visibility, UW was dealing with version control issues as well. **They had many versions and implementations of authorization logic. The policy evaluation logic was scattered across Utility Warehouse’s code base.**
 

[#quote#]

# Business Needs

## Security, compliance, and consistency

Taking stock of Utility Warehouse’s authorization challenges, alongside the requirements of the business, Rob knew that they needed a centralized, secure, and SOC/ISO-compliant way of managing access control. 

**As an FTSE 250 company in a regulated market, they need to be able to track who accesses their systems and why.** So creating a system that was auditable, with automatic logs that are easy to read, would be a great advantage. Centralizing their access control policies in one place would make it easier to enforce security standards. And it would simplify their access logs for easier auditing. 
 


[#graysection#]

[#quote#]

# Results

## A more transparent and reliable authorization system requiring minimal upkeep

UW’s access control system was in bad shape, but after implementing Cerbos, Rob feels they successfully averted a crisis. “If we had kept our old system for more than 6 months or a year, we would have been in trouble. Cerbos came along with a product that let us bootstrap and move quickly,” he says. 

Rob and his team don’t wrangle scattered authorization logic across 4,500 services anymore. Everything is managed and deployed through one decoupled Policy Decision Point. **It takes a few minutes to make changes rather than days rooting out disparate pieces of code.** 

Rob and his team also have total visibility into why a user is granted or denied access or permission. **They have comprehensive audit trails that enable Rob to follow the evolution of access policies through time.**  
 

[#quote#]

As a result, Rob is more confident than ever before that Utility Warehouse’s authorization logic is accurate and secure. They don’t worry about errors when they apply permissions. Instead, they use the quality control capability within Cerbos to test policies before deployment. 

“We have a proper tool to depend on and I trust Cerbos’ workflows. If the green tick says that it is built, then we know it should work,” he says. 

Eliminating the massive task of detangling permissions logic, Rob and his team have more time to focus on building UW’s software. **“Cerbos allows our team to focus on getting rid of technical debt and other business use cases instead of wondering how to write a policy evaluation language,”** he explains.

Throughout the process of evaluating and implementing Cerbos, Rob also appreciated the expertise, honesty, and willingness to take feedback demonstrated by the Cerbos team. “The Cerbos team is smart, humble, transparent, and nice. Our relationship feels like a partnership, and everything they've built has answered a need for us,” he says, “**It's weird to say an outside company has our back, but Cerbos does.** It's the people. It's their open-source code: it's high quality, you can read it, it does what it says on the tin.”

### Related links
* <a href="https://www.cerbos.dev/blog/how-utility-warehouse-upgraded-and-centralized-its-access-control-system-with-cerbos">Full interview Rob Crowe</a>
* <a href="https://www.cerbos.dev/customers/human-managed">Human Managed creates a future-proof ABAC engine with Cerbos</a>
* <a href="https://www.cerbos.dev/customers/ntwrk">NTWRK makes a complex access control system easy to manage with Cerbos</a>
### Learn more about Cerbos
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/human-readable-authorization">Human-readable authorization</a>
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/read-eval-print-loop-repl">Read–eval–print loop (REPL)</a>
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/scalability">Scalability</a>
* <a href="https://www.cerbos.dev/features-benefits-and-use-cases/audit-logs">Audit logs</a>

Months of developer time reclaimed from boring maintenance

Enhanced reliability and transparency for access control

Eliminated technical debt from authorization

An FTSE 250 Index company replaces a cumbersome in-house authorization system with decoupled, centralized authorization management, gaining enhanced reliability and transparency.

Customer success story: Utility Warehouse synchronizes authorization across 4,500 services

Utility Warehouse

Cerbos has a grammar in their YAMLs that we can trust. What we had before was the wild west. It was thousands of lines of code.

We realized that our 200+ engineers were doing their own thing, we didn’t have a standard way of doing authorization.

One of our favorite features is the audit logs because it allows us to understand what is happening in the black box. We didn’t know we needed that.

We have a proper tool to depend on and I trust Cerbos’ workflows. If the green tick says that it is built, then we know it should work.

Success story

Utility Warehouse synchronizes authorization across 4,500 services

Case Study