# Cerbos Policy Schema
This document describes the schema for defining policies in Cerbos.

## Definitions
### Condition
Conditions are used to specify the rules for access decisions.
- **match**: A matching condition.
- **script**: A string specifying a custom script.

### Constants
Constants are variables that can be reused within the policy.
- **import**: An array of strings representing imported values.
- **local**: An object representing local values.

### Derived Roles
Defines a role that can derive permissions from other roles.
- **name**: The name of the derived role.
- **definitions**: An array of role definitions.

### Principal Policy
Defines a policy for a specific principal (user/group).
- **principal**: A string representing the principal identity.
- **rules**: An array of rules that specify actions allowed or denied.

### Resource Policy
Defines a policy for a specific resource.
- **resource**: A string representing a resource identifier.
- **rules**: An array of rules governing access to the resource.

### Role Policy
Defines permission rules for a specific role.
- **role**: The name of the role.
- **rules**: An array of rules related to the role.

### Metadata
Additional information about the policy.
- **annotations**: Key-value pairs for additional adjustments.
- **sourceAttributes**: Attributes defining the source of the policy.

## Rule Structure
Each rule in the policies can have:
- **actions**: Array of actions that define what can be done.
- **effect**: Denotes whether the action is allowed or denied.

## Conditions Example
The following is an example of a matching condition:
- **all**: A condition that must be satisfied by all elements.
- **any**: A condition that can be satisfied by any element.
- **none**: A condition that must not be satisfied by any element.

These rules and structures can be combined to create comprehensive access control policies in Cerbos.