cedar policy evaluation from python

[Arunkumar83]

Hi,

We tested ACS with rego policy. Also we ant to evaluate cedar policies as per our requirement. Though we could see cedar support and its dispatcher, but we couldn't find its corresponding dispatcher in Python sdk. We have written our own Custom dispatcher and using cedarpy library as workaround. Is there any documentation where it explains about cedar policy evaluation using ACS with python.

Thanks,
Arunkumar

[Goutam Adwant (goutamadwant)]

You are not overlooking a Cedar-specific class in the ACS Python SDK. At the moment, Python exposes an engine-neutral PolicyDispatcher protocol with one evaluate(invocation) method.

The important distinction is:

• The ACS Python SDK's zero-configuration policy dispatcher is currently Rego-only. The native default explicitly rejects non-Rego policies.
• The repository also has agentmesh.governance.CedarEvaluator, backed by cedarpy/CLI, but that is the AgentMesh policy API. It is not directly an ACS PolicyDispatcher, because ACS supplies a prepared invocation and expects a verdict-shaped result.

So your custom cedarpy dispatcher is currently the correct integration for an ACS manifest. Pass it through the generic hook:

from agent_control_specification import AgentControl

control = AgentControl.from_path(
    "governance.acs.yaml",
    policy_dispatcher=MyCedarDispatcher(),
)

Its evaluate() method receives a mapping whose type is cedar, together with policy_set or policy_path, optional entities_path, schema_path, and query, plus input and canonical_input. It must return an ACS verdict-shaped mapping such as an allow or deny decision; raising or returning malformed output fails closed.

The Rust core does contain a CedarBuiltinDispatcher, and the Python native extension enables the Cedar feature, but the default dispatcher factory is still wired only to OPA/Rego. That is why simply loading a Cedar manifest from Python does not select a Cedar dispatcher automatically.

The current Rego/Cedar tutorial does not make this Python-specific boundary clear. A useful documentation fix would be to state that ACS Python requires the generic custom dispatcher today and to include a complete cedarpy example.

[Ali Pourrahim (Aliipou)]

Why this project exists: evaluating Cedar from Python is necessary and not sufficient. Cedar should remain the policy language. Something else must still sign, mint once, and refuse to run the tool if that signature is missing. That is the only reason we built a Python kernel around the official Cedar CLI.

If you only need evaluate Cedar from Python as a PDP:

from decision_os_min import Kernel, CedarCLIAuthorityPDP

pdp = CedarCLIAuthorityPDP(cedar_bin, policies=..., entities=..., policy_revision="...")
kernel = Kernel(policy, authority_pdp=pdp)

The adapter maps permit/deny and strips everything else. Cedar never sees the signing key or the adapters.

https://github.com/Aliipou/decision-os-min/blob/main/docs/COMPARISON.md

Complementary to ACS/Cedarling (#3791), not a replacement.

[Ali Pourrahim (Aliipou)]

Why this project exists: evaluating Cedar from Python is necessary and not sufficient. Cedar should remain the policy language. Something else must still sign, mint once, and refuse to run the tool if that signature is missing. That is the only reason we built a Python kernel around the official Cedar CLI.

If you only need evaluate Cedar from Python as a PDP:

from decision_os_min import Kernel, CedarCLIAuthorityPDP

pdp = CedarCLIAuthorityPDP(cedar_bin, policies=..., entities=..., policy_revision="...")
kernel = Kernel(policy, authority_pdp=pdp)

The adapter maps permit/deny and strips everything else. Cedar never sees the signing key or the adapters.

https://github.com/Aliipou/decision-os-min/blob/main/docs/COMPARISON.md

Complementary to ACS/Cedarling (#3791), not a replacement.

[Ali Pourrahim (Aliipou)]

If this is useful, please star the public edition so other philosophers and labs can find it:

https://github.com/Aliipou/freedom-theory

Book + sixteen-chapter path + justification. CC BY 4.0. Not a Cedar/OPA competitor.

[Ali Pourrahim (Aliipou)]

Looking for collaborators on decision-os-min — the authority + audit PEP, not a Cedar rewrite.

We need people who will try to mint or run an effect without a signed unspent grant; Hosted-plane / TM-A isolation (still PARTIAL); Cedar/OPA adapters that cannot mint.

Call + how to join: Aliipou/decision-os-min#3

[Kevin Knapp (Knapp-Kevin)]

One distinction worth keeping clear here: #3791 is specifically about Cedarling, not about requirements Cedar itself imposes on an ACS integration.

That issue proposes restoring an optional Cedarling integration through the ACS v5 PolicyDispatcher extension point after the old v4 backend contract was removed. It does not establish that Cedar requires a separate signing/minting kernel around it, or that such a kernel is part of the ACS contract.

For Arunkumar's original question, the gap is narrower: ACS Python exposes the engine-neutral PolicyDispatcher seam, while the Rust core has a first-party Cedar implementation. Today, a Python consumer therefore needs to provide the Cedar dispatcher implementation itself.

Cedarling may be useful where its additional capabilities are specifically needed, but that is a separate architectural choice from simply evaluating Cedar through ACS Python. I think keeping those layers distinct will make this thread more useful to someone trying to understand the supported Cedar path.

[Ali Pourrahim (Aliipou)]

Kevin Knapp (@Knapp-Kevin) that distinction is correct, and I should not have blurred it.

#3791 is Cedarling through ACS PolicyDispatcher, not a claim that Cedar requires a signing/minting kernel, and not a claim that such a kernel is part of the ACS contract. For Arunkumar’s question the gap is narrower: Python ACS exposes an engine-neutral dispatcher; the Rust core has first-party Cedar; a Python consumer supplies the Cedar dispatcher.

decision-os-min is an optional PEP around a PDP. Cedar stays the policy language. Our Cedar CLI adapter maps permit/deny and cannot mint. That is a different layer from “the supported Cedar path in ACS Python.” I will not treat a minting kernel as implied by ACS or by #3791.