These are reference implementations of adapters that take a Cerbos Query Plan (PlanResources API) response and convert it into a filter which can be applied to your data fetching layer to return just the instances of a resource that a user would have access to.
Current supported adapters:
- ActiveRecord (Ruby) — work-in-progress prototype. Not ready for production use.
- Convex
- Drizzle ORM
- Elasticsearch (Java)
- Ent (Go)
- LangChain / ChromaDB
- Mongoose
- pgx (Go)
- Prisma
- Spring Data JPA
- SQLAlchemy
Warning
The ActiveRecord adapter is a work-in-progress prototype. It has not been released, it
has not been used in production by anyone, and its public interface can still change without
a deprecation. Do not depend on it to enforce access control in a live system yet. See
activerecord/README.md for what it does and does not cover.
Every adapter is proved against two shared corpora at the root of this repository:
conformance/— deliberately hostile shapes, proving each adapter's filter returns exactly the rows the PDP allows.demo/— one realistic domain, proving each adapter's published package installs, imports, and composes with its ORM's real query methods.