Again, something is going over my head. Cedar has nothing to do with AWS except that it's open sourced by AWS (I think?). It has nothing to do with IAM, an exi

Again, something is going over my head. Cedar has nothing to do with AWS except that it's open sourced by AWS (I think?). It has nothing to do with IAM, an existing way to model policy specifically for AWS owned resources. What you do once you model your application's authorization concerns in Cedar to make it so action:foo is exposed as usable on resource:bar is up to you, and your business. An anaylzer can be implemented on top of this for your domain and offer the functionality you're describing, but that seems out of scope for Cedar the modeling specification and evaluation engine to provide. Imagine Cedar as a way for you, a SaaS provider, to add granular access policies like AWS for your own specific resources be it customers, rental cars, food orders, or advertising campaigns. I suspect the majority of use cases aren’t multi-tenant SaaS concerns but very complex authorization over resources internally across services in an organization. Does micro service A have access to update data on resource bar? It’s still hard to model and enforce those things as organizations grow, especially in a domain specific way.