Cerbos Query Plan Adapters

These are reference implementations of adapters that take a Cerbos Query Plan (PlanResources API) response and convert it into a filter which can be applied to your data fetching layer to return just the instances of a resource that a user would have access to.

Current supported adapters:

• ActiveRecord (Ruby) — work-in-progress prototype. Not ready for production use.
• Convex
• Drizzle ORM
• Elasticsearch (Java)
• Ent (Go)
• LangChain / ChromaDB
• Mongoose
• pgx (Go)
• Prisma
• Spring Data JPA
• SQLAlchemy

[!WARNING] The ActiveRecord adapter is a work-in-progress prototype. It has not been released, it has not been used in production by anyone, and its public interface can still change without a deprecation. Do not depend on it to enforce access control in a live system yet. See activerecord/README.md for what it does and does not cover.

Every adapter is proved against two shared corpora at the root of this repository:

• conformance/ — deliberately hostile shapes, proving each adapter's filter returns exactly the rows the PDP allows.
• demo/ — one realistic domain, proving each adapter's published package installs, imports, and composes with its ORM's real query methods.