Verified Permissions

Amazon Verified Permissions is one deployment vehicle for Cedar. It is not the only one, and the lexicon does not privilege it.

The seam

chant already ships the deployment half. AWS::VerifiedPermissions::Policy in the aws lexicon carries its policy text in definition.static.statement, typed CedarPolicy — which is to say, string. That string is the seam.

cedar lexicon                        aws lexicon
schema -> Policy -> .cedar text  ->  VerifiedPermissionsPolicy.definition.static.statement

Everything upstream of the string — the schema, entity types, actions, scope constraints — belongs to this lexicon. Everything downstream — the policy store, the CloudFormation ApplyOp, the IAM around it — belongs to the aws lexicon and already works.

What ships today

A policy’s statement text is what the serializer emits for that one entity — the same bytes as the .cedar file, so the deployed policy and the reviewed file cannot disagree.

import { Policy, ReadAction } from "@intentius/chant-lexicon-cedar";

export const ownerRead = new Policy({
  effect: "permit",
  principal: { is: "App::User" },
  action: { eq: ReadAction },
  resource: { is: "App::Document" },
  when: ["resource.owner == principal"],
});

The avp-embedding init template scaffolds a multi-tenant store’s schema and a three-policy set shaped for one.

What is deferred

A typed handoff — a VerifiedPermissionsPolicy whose statement accepts a Policy value directly rather than a string a caller assembled — is landing with INTENTIUS/chant#1652, along with describeResources()/observeAmbient() against a live policy store and the ownership-channel design.

Until it does:

• Do not hand-type a statement string. A prose "permit(principal, action, resource);" inside an AVP resource is exactly what this lexicon exists to remove, and the bare-permit wall fails it in a prod build.
• Do not tag individual policies for ownership. Stores are taggable; policies are not.
• Treat an ambient permit as a finding. A permit in a store that no source file declares is a standing grant made outside review.

The other evaluators

If the target is not AVP there is no embedding step at all — emit the files and ship them.

Target	How
cedar-agent	Point it at the emitted .cedar and an entity store
Embedded cedar-wasm	Load the policy text in-process, call isAuthorized
Edge / Cloudflare-style	The same file, read at the edge

Cedar for Kubernetes

The CNCF push includes Cedar as a Kubernetes authorizer with policies as CRDs. Those kinds belong to the k8s lexicon’s CRD sources — the same rule that kept helm.cattle.io out of k3s. What this lexicon does there is lint the policy text embedded in those kinds, the pattern the ARGO rules already use.