Cerbos Query Plan Adapters

Turn a Cerbos query plan into a database filter, so a list query returns only the records the current user is allowed to see.

You call Cerbos's PlanResources API with a principal, a resource kind and an action. Cerbos answers with one of three plan kinds: always allowed, always denied, or conditional with an expression tree. An adapter turns that tree into the native filter for your ORM or store (a Prisma where, a SQL fragment, a Mongo query, an Elasticsearch query, and so on) using a mapping you provide from Cerbos attribute paths (request.resource.attr.status) to your fields.

Pick an adapter

Store / ORM	Language	Install	Docs
Prisma	TypeScript	npm install @cerbos/orm-prisma @cerbos/core	prisma
Drizzle ORM	TypeScript	npm install @cerbos/orm-drizzle @cerbos/core	drizzle
Mongoose	TypeScript	npm install @cerbos/orm-mongoose @cerbos/core	mongoose
Convex	TypeScript	npm install @cerbos/orm-convex @cerbos/core	convex
LangChain.js / ChromaDB	TypeScript	npm install @cerbos/langchain-chromadb @cerbos/core	langchain-chromadb
SQLAlchemy	Python	pip install cerbos-sqlalchemy	sqlalchemy
Ent	Go	go get github.com/cerbos/query-plan-adapters/ent	ent
pgx / PostgreSQL	Go	go get github.com/cerbos/query-plan-adapters/pgx	pgx
Spring Data JPA	Java	Build from source (not yet on Maven Central)	spring-data
Elasticsearch	Java	Build from source (not yet on Maven Central)	elasticsearch-java
ActiveRecord	Ruby	Not released yet	activerecord

Each adapter's README starts with an install step and a quick-start snippet.

Warning

The ActiveRecord adapter is a work-in-progress prototype. It is unreleased, has not been used in production, and its interface may change without deprecation. Do not rely on it to enforce access control in a live system yet.

The shape of every integration

1. Ask Cerbos for a plan: planResources({ principal, resource: { kind }, action }).
2. Pass the plan and your attribute mapping to the adapter.
3. Branch on the result: return nothing for always denied, run the query unfiltered for always allowed, and apply the returned filter for conditional.

If a policy uses a shape the adapter cannot express in your store, the adapter throws rather than return a filter that might over-grant. Each adapter's Conformance contract section lists what it supports and what it refuses.

How the adapters are tested

Every adapter is tested against two shared corpora in this repository:

• conformance/: hostile policy shapes, written as cases, and seed rows. The plans and check() decisions of two pinned Cerbos PDP releases (the current one and the one before) are recorded per case. Each adapter translates every recorded plan, runs it against a real store, and must return exactly the rows the PDP allowed, or throw.
• demo/: one realistic domain. Each adapter's example app installs the packaged adapter and uses it with its ORM's real query methods. The Go adapters use a local replace directive, so their examples cover usage but not packaging.

Contributors: start with CLAUDE.md, conformance/README.md and CODING_STANDARDS.md.

License

Apache 2.0