Cedar: A Language for Expressive, Fast, Safe, and Analyzable Authorization

Inside the event

Title: Cedar: A Language for Expressive, Fast, Safe, and Analyzable Authorization Speaker: Michael Hicks, the Cecilia Fitler Moore Professor and Associate Chair in the Department of Computer and Information Science at the University of Pennsylvania and Director of the Schlein Center for Cybersecurity Abstract: Cedar is an authorization policy language: Rather than embed authorization logic in an application’s code, developers can write that logic as Cedar policies and delegate access decisions to Cedar’s evaluation engine. Cedar is designed to be ergonomic, fast, safe, and analyzable. Cedar’s simple and intuitive syntax supports common authorization use-cases with readable policies, naturally leveraging concepts from role-based, attribute-based, and relation-based access control models. Cedar’s policy structure enables access requests to be decided quickly. Cedar’s design has been finely balanced to allow for a sound and complete logical encoding, which enables precise policy analysis, e.g., to ensure that when refactoring a set of policies, the authorized permissions do not change. Cedar is open-source, implemented in both Rust and Go for fast execution, and faithfully modeled in the Lean verification-oriented programming language, to support proof of important security and correctness properties. These implementations are kept in sync using differential random testing. Cedar is now used in a variety of real-world settings, including as a means to authorize AI agent actions, and these deployments have led to further expansion and extension of its capabilities. This talk will present a full overview of Cedar, how it is used today, and research underway to expand and improve its capabilities. Speaker Bio: Michael Hicks is the Cecilia Fitler Moore Professor in Computer and Information Science at the University of Pennsylvania, and Director of the Schlein Center for Cybersecurity. He was previously a Senior Principal Applied Scientist at Amazon Web Services (2022-2025) and a Professor at the University of Maryland (2002-2021). His research explores how to apply novel programming languages, program analysis, and automated testing techniques to solve problems in security, software engineering, systems, databases, networks, and quantum computing. The Computer Science Colloquium Series will be held weekly on Thursdays at 2:30pm in SEC LL2.224. There will be refreshments before the talk at 2:00pm.