These are reference implementations of adapters that take a Cerbos Query Plan (PlanResources API) response and convert it into a filter which can be applied to your data fetching layer to return just the instances of a resource that a user would have access to.
Current supported adapters:
- ActiveRecord (Ruby) — work-in-progress prototype. Not ready for production use.
- Convex
- Drizzle ORM
- Elasticsearch (Java)
- Ent (Go)
- LangChain / ChromaDB
- Mongoose
- pgx (Go)
- Prisma
- Spring Data JPA
- SQLAlchemy
Warning
The ActiveRecord adapter is a work-in-progress prototype. It has not been released, it
has not been used in production by anyone, and its public interface can still change without
a deprecation. Do not depend on it to enforce access control in a live system yet. See
activerecord/README.md for what it does and does not cover.
Every adapter is proved against two shared corpora at the root of this repository:
conformance/— deliberately hostile shapes, proving each adapter's filter returns exactly the rows the PDP allows.demo/— one realistic domain, proving each adapter's published package installs, imports, and composes with its ORM's real query methods. Ent and pgx use local Go module replacements and prove usage shapes only, not packaging.