feat: Cedar policy engine — AWS ecosystem authorization alternative to OPA/Rego

[nfvelten]

Migrated from nfvelten/arbitus#121

Summary

Cedar is Amazon's authorization policy language (used in AWS Verified Permissions and AWS AgentCore). Organizations already using AWS IAM/Verified Permissions could use their existing Cedar policies with Arbitus. This unlocks the AWS enterprise market without competing with AWS AgentCore directly.

agentgateway chose CEL. Arbitus has OPA/Rego. Cedar adds a third option targeting AWS-heavy enterprises.

Implementation

• middleware/cedar.rs alongside existing middleware/opa.rs
• Cedar Rust SDK (cedar-policy crate from AWS)

rules:
  cedar:
    policy_path: "policy.cedar"
    schema_path: "schema.cedarschema"  # optional

References

• PROPOSAL.md §2.6
• Cedar Policy Language