Home / Articles / Cedar and the policy vault / Versions / v1.2.0
Cedar and the policy vault: what changed in v1.2.0
From v1.1.0 (2026-10-19, d303ce0f1) to v1.2.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 51 unchanged. About 0 words added and 122 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot cd-pipeline.webp | images/ | Cedar policies in an sgit vault, from the rule to the evidence: a gate that validates every version against the schema and its tests, tagsgate, signed by the releasing clone,tags, enforcement points that clone with the read key only, andpoints, an append lane that keeps a sealed record of every decision. What ran in the demo for this article is solid; the gateway and the sync into managed stores are proposed.lane. | architecture
17 unchanged paragraphs, under In short {#in-short}, Why Cedar {#why}, Cedar in five ideas {#language}…
!shot cd-crosswalk.webp | images/ | Our behaviour-policy terms, Cedar's, and where each one lives in the vault.vault, Most map directly:with the grant is permit, the barrier is forbid, the footprint is the entities. Two have notwo Cedar construct, the mandate and the version in force, and those are what the vault adds.lacks. | comparison
4 unchanged paragraphs, under How Cedar policies are kept today {#today}
!shot cd-today.webp | images/ | Amazon Verified Permissions as its documentation describes it, a plain repository, and the vault from the demo. The managed store validates strictly and is protected by IAM, but its API has no history or export, and deleting it is permanent. A repository has history but no keys. The vault has both, and puts the evidence next to the rules. | comparison
28 unchanged paragraphs, under The demo {#demo}, What a vault adds {#adds}, A brief for the MVP {#brief}…