CI/CD policy uploads: what IAM teams should watch

TL;DR: A CircleCI workflow that pushes policy files to Cerbos Hub on main-branch changes, using stored client credentials and environment variables to authorise the upload, is described by Cerbos. The pattern is operationally convenient, but it also concentrates trust in CI/CD secrets and access scoping that identity teams must govern as NHI controls, not just build plumbing.

NHIMG editorial — based on content published by Cerbos: a guide to automatically uploading Cerbos policies from CircleCI to Cerbos Hub

Questions worth separating out

Q: How should security teams govern CI/CD jobs that write to policy stores?

A: Treat the job as a privileged non-human identity.

Q: Why do CI/CD environment variables create identity risk?

A: Because they often act as standing credentials inside an execution context that repeats many times.

Q: What breaks when a build job has more access than the policy change itself requires?

A: The pipeline becomes a control-plane shortcut.

Practitioner guidance

• Classify the pipeline as an NHI Document the CircleCI job as a non-human identity with write authority, then assign an owner, an approval path, and a revocation process for its credentials.
• Replace long-lived client secrets Move Cerbos Hub access out of static environment variables where possible and reduce the chance that build context can reuse the same write capability indefinitely.
• Limit the write blast radius Separate policy upload authority from broader repository or deployment permissions so a compromised job cannot move beyond the intended policy store action.

What's in the full article

Cerbos' full guide covers the operational detail this post intentionally leaves for the source:

• The exact CircleCI config block used to upload policies into Cerbos Hub.
• The environment variable setup process for storing client ID and client secret values in CircleCI.
• The branch filter and workflow wiring needed to trigger uploads only from the main branch.
• The verification steps for checking the upload-policies job status inside CircleCI.

👉 Read Cerbos' guide to uploading policies from CircleCI to Cerbos Hub →

CI/CD policy uploads: what IAM teams should watch?

Explore further

View Full Forum →  |  NHI Foundation Course →