Per-request authorization
Who, on whose behalf, for which resource, under which policy revision.
01Runtime policy for internal tools
Every internal endpoint gets a decision record, not a shared password in a vault.
Cybal is the boring, load-bearing part of runtime policy for internal tools. Built by a small team, shipped weekly.
Overview
Runs
Policies
Traces
Settings
Runtimelive
300hand-cut IAM policies retired
4 msp99 decision latency
Per-request authorizationok
Decision recordsok
Revocation that landsok
Teams shipping with Cybal
NorthwindKestrelRuangPolarTokoLumenBakauVela
What you get
Three things Cybal does properly.
Decision records
Every allow and deny is written down with the inputs hashed and the rule cited.
02Revocation that lands
Kill a capability and the next call fails. No token lifetime games.
03“The first audit after Cybal took an afternoon. The one before took a month of screenshots.”
Rangga P. — security lead, Jakarta
300hand-cut IAM policies retired
4 msp99 decision latency
100%of denials explained
Inside the product
One screen, the whole picture.
Overview
Runs
Policies
Traces
Settings
Runtimelive
300hand-cut IAM policies retired
4 msp99 decision latency
Per-request authorizationok
Decision recordsok
Revocation that landsok
Pricing
Start free. Pay when it earns it.
Questions
The things people ask first.
Do we rewrite our services?+
No. A sidecar or a single middleware call, depending on your stack.
Can policy be code?+
Yes — reviewed in the same repo, deployed with the same pipeline.
What about break-glass?+
Time-boxed, two-person, and it produces a louder record than a normal allow.
Cybal is open for design partners.
Small team, direct access to the people who build it. Bring a real workload.
Request access