Cerbos Policy Schema

This document describes the schema for defining policies in Cerbos.

Definitions

Condition

Conditions are used to specify the rules for access decisions.

• match: A matching condition.
• script: A string specifying a custom script.

Constants

Constants are variables that can be reused within the policy.

• import: An array of strings representing imported values.
• local: An object representing local values.

Derived Roles

Defines a role that can derive permissions from other roles.

• name: The name of the derived role.
• definitions: An array of role definitions.

Principal Policy

Defines a policy for a specific principal (user/group).

• principal: A string representing the principal identity.
• rules: An array of rules that specify actions allowed or denied.

Resource Policy

Defines a policy for a specific resource.

• resource: A string representing a resource identifier.
• rules: An array of rules governing access to the resource.

Role Policy

Defines permission rules for a specific role.

• role: The name of the role.
• rules: An array of rules related to the role.

Metadata

Additional information about the policy.

• annotations: Key-value pairs for additional adjustments.
• sourceAttributes: Attributes defining the source of the policy.

Rule Structure

Each rule in the policies can have:

• actions: Array of actions that define what can be done.
• effect: Denotes whether the action is allowed or denied.

Conditions Example

The following is an example of a matching condition:

• all: A condition that must be satisfied by all elements.
• any: A condition that can be satisfied by any element.
• none: A condition that must not be satisfied by any element.

These rules and structures can be combined to create comprehensive access control policies in Cerbos.