Justin dropped the link in the team Slack at 8:14 AM: docs.cedarpolicy.com. No preamble, no context, no "hey team check this out when you get a chance." Just the URL, bare and unadorned, the way Justin shared things when he believed the thing would speak for itself.
Jay clicked it first. He always clicked first. It was a reflex born of years on Hacker News, where the interesting things vanished if you didn't read them immediately.
Cedar was a policy language. Not a framework, not a platform, not a product with a pricing page and a sales team. A language. You wrote policies in it the way you wrote sentences in English, except that every sentence was a permission or a prohibition, and the grammar was designed so that a machine could evaluate a million of them in milliseconds.
permit(principal == Agent::"claude", action == Action::"file.read", resource == Resource::"workspace/*");
Jay read the documentation from top to bottom. He read the specification. He read the examples. He read the section on entity hierarchies and the section on policy templates and the section on partial evaluation. Two hours disappeared the way two hours disappear when you find a well-designed system and want to understand every corner of it.
"This is how we govern the agents," he typed back in Slack. No emoji. Just the sentence.
Justin responded with a single thumbs-up.
Navan, meanwhile, had opened a new file. He didn't need to read the entire specification before he started writing. That was the difference between Jay and Navan—Jay wanted to understand the terrain before taking a step, and Navan wanted to take a step to understand the terrain. Both approaches worked. Both approaches were necessary.
Navan's first Cedar policy was twelve lines long. It permitted the Claude agent to read any file in the workspace directory. It permitted the Claude agent to write files only in subdirectories it had created itself. It denied the Claude agent access to anything in /etc, /var, or /usr. It denied network access to any domain not explicitly whitelisted.
He stared at the twelve lines. They were plain. They were readable. A non-engineer could parse them. That was the point, he realized. Policy languages that required a PhD to interpret were policy languages that nobody reviewed. Cedar was designed to be read by the people who cared about what the policy said, not just the people who knew how to write it.
Navan committed the policy file to the Leash repository. He wrote in his physical notebook: First Cedar policy. Twelve lines. Governs an AI agent. The future is surprisingly legible.
Jay found the commit an hour later and left a review comment: "This is clean. One thought—should we template the workspace path so it's not hardcoded?"
Navan pushed an update. The policy became eleven lines, with a template variable.
Justin never commented on the PR. He just merged it. That was his highest compliment: silent acceptance, the absence of objection, the trust that comes from watching someone do a thing correctly on their first try.
Twelve lines. Then eleven. The first Cedar policy was alive.
The characterization of Jay vs Navan's learning styles is so sharp. Jay reads the whole spec. Navan writes the first policy. Both are right. Both are needed. That's what a good team looks like.