Cedar

The cedar lexicon is the typed authoring layer above Cedar, the vendor-neutral authorization policy language that joined the CNCF as a Sandbox project in December 2025.

Cedar is deliberately abstraction-free: no variables, no modules, no loops, and templates carrying exactly two slots (?principal, ?resource). Its own toolchain validates and evaluates — it checks policies after they are written and decides requests at runtime. Everything upstream of the policy text is unowned, which is where this lexicon lives.

npm install --save-dev @intentius/chant-lexicon-cedar

Quick start

import { Policy, ReadAction } from "@intentius/chant-lexicon-cedar";

export const ownerRead = new Policy({
  effect: "permit",
  principal: { is: "App::User" },
  action: { eq: ReadAction },
  resource: { is: "App::Document" },
  when: ["resource.owner == principal"],
});

ReadAction and "App::User" are generated from your Cedar schema, so a renamed entity type is a compiler-guided refactor and a typo’d action is a compile error — not a validation failure after the text is written.

What comes out

File	Who reads it
<name>.cedar	Every Cedar evaluator — Amazon Verified Permissions, cedar-agent, an embedded cedar-wasm
policies.cedar.json	The Cedar JSON policy format; also the parse source for import

chant appears in neither. An emitted policy set walks away and is consumed by any evaluator with chant nowhere in sight.

Cedar is a target, never a gate

There is no cedarGate() and there will not be one. Organizational policy in chant is TypeScript post-synth checks; a second policy engine would duplicate the lint engine. chant compiles to Cedar; it is not governed by Cedar.

The dogwood dialect

Cedar with temporal operators, shipping inside this lexicon as a pre-release surface under the DWD id family: a policy that can depend on what already happened in a session. Start at The Dogwood Dialect, which is honest about upstream’s governance before it shows you a builder.

At a Glance

Metric	Count
Resources	17
Property types	16
Services	2
Intrinsic functions	0
Pseudo-parameters	0
Lint rules	18

Lexicon version: 0.57.0
Namespace: Cedar

• All Rules — 18 rules
• Serialization — output format details