Policy schema

This is the JSON schema for the Cerbos policy.

Definitions

Conditions

Condition could contain a match or a script.

Constants

Constants include imported items and local definitions.

Derived Roles

DerivedRoles include constants, definitions, name, and variables.

Export Constants

Includes definitions and a name.

Export Variables

Includes definitions and a name.

Match Criteria

Match has criteria for all, any, none, or a single expression.

Metadata

Includes various properties like annotations and source file details.

Principal Policy

PrincipalPolicy requires a principal and version, alongside constants, rules, scope, and variables.

Resource Policy

ResourcePolicy specifies the resource, version, constants, rules, and more.

Role Policy

RolePolicy contains the role name, parent roles, and associated rules.

Examples

• Condition Example: A condition could check for permissions based on the user role.
• Principal Policy Example: A principal policy for managing user roles.
• Resource Policy Example: Framework setup for managing different resources with specific permissions.

{
    "apiVersion": "api.cerbos.dev/v1",
    "derivedRoles": {...},
    "principalPolicy": {...},
    "resourcePolicy": {...},
    "rolePolicy": {...}
}