Cedar is a flexible, extensible, and scalable policy-based access control language, helping developers express application permissions as policies. Administrators and developers can define policies that permit or forbid users to act on application resources. Multiple policies can be attached to a single resource. When a user of your application attempts to perform an action on a resource, your application makes an authorization request to the Cedar policy engine. Cedar evaluates the applicable policies and returns an ALLOW or DENY decision. Cedar supports authorization rules for any type of principal and resource, allows for role-based and attribute-based access control, and supports analysis through automated reasoning tools.