• ALLOWED
  • DENIED
  • ERROR
  • HUMAN

How to verify user permissions with your AI

Connect Cerbos to your agent to run permission checks against your existing policies instantly.

Ask AI about this page

Short answer

Can my AI check user permissions?

Yes. Your agent uses Cerbos to evaluate whether a specific identity has the right to perform an action on a resource. This allows your AI to respect your existing security logic without you writing new code.

Where every check lands.

Permission outcomes

The AI processes your request and delivers one of these results.

ALLOWED

Access granted

The agent confirms the user has permission. It proceeds with the requested task or provides the data you asked for.

DENIED

Access blocked

The agent identifies a policy violation. It stops the action and tells you exactly why the request was rejected.

ERROR

Policy failure

The agent hits a snag with the policy evaluation. You'll get details on what went wrong with the check itself.

HUMAN

Manual review

If the policy is ambiguous or requires a specific override, the agent flags the issue for you to decide.

The workflow

What your AI does when a permission check arrives.

The agent bridges the gap between your natural language request and your Cerbos policy engine.

  1. Identify the request

    The agent parses your prompt to extract the user identity, the action being attempted, and the target resource.

    check_resources

  2. Evaluate against Cerbos

    The agent sends the extracted data to Cerbos to run a formal permission evaluation.

    authzen_evaluation

  3. Verify resource context

    The agent checks the specific attributes of the resource to ensure the policy matches the current state.

    check_resources

  4. Report the decision

    The agent delivers the final allow or deny decision back to your chat interface.

    authzen_evaluation

Try it

Copy these to start.

Use these prompts to trigger permission checks immediately.

Starting points

Swap out the bracketed text with your actual user IDs, roles, or resource names.

Cerbos Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_y0c5dNo7ENj8oh5gsdkYK0hZAMSRgY44sro1JyED/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Cerbos capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "cerbos-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_y0c5dNo7ENj8oh5gsdkYK0hZAMSRgY44sro1JyED/mcp"
    }
  }
}
Copy into chat04

  • Can user 'admin_01' edit the 'project_alpha' resource?

  • Check if the 'editor' role has permission to delete 'document_44'.

  • Does 'user_99' have access to the 'billing_dashboard'?

  • Verify if the current user can view 'customer_record_7' based on our policies.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Cerbos once, then ask.

One connection gives your agent access to your policies. Your credentials stay encrypted and secure.

Connect Cerbos to your AI

FAQ

How the permission check behaves

  • 01

    Can the AI change user permissions?

    No. The agent can only evaluate existing policies. It cannot create, delete, or modify any Cerbos policies or user roles.

  • 02

    Will the AI bypass my security rules?

    No. The agent is strictly bound by the logic defined in your Cerbos policies. If a policy says 'deny', the agent cannot override it.

  • 03

    What happens if a resource isn't found?

    The agent will report that it cannot complete the check because the resource does not exist in the context provided.

  • 04

    Does the AI store my policy data?

    No. The agent uses the data to perform the evaluation and does not retain your policy definitions or user attributes.

  • 05

    Can I use this for real-time access control?

    The agent performs evaluations based on the tools provided, allowing it to act as a real-time check for your conversational workflows.

  • More questions about Cerbos? See everything the Cerbos Connector can do

Connect Cerbos to Claude, Cursor, ChatGPT & more