# Policy schema

This is the JSON schema for the Cerbos policy.

## Definitions

### Conditions

`Condition` could contain a `match` or a `script`.

### Constants

Constants include imported items and local definitions.

### Derived Roles

`DerivedRoles` include constants, definitions, name, and variables.

### Export Constants

Includes definitions and a name.

### Export Variables

Includes definitions and a name.

### Match Criteria

`Match` has criteria for `all`, `any`, `none`, or a single expression.

### Metadata

Includes various properties like annotations and source file details.

## Principal Policy

`PrincipalPolicy` requires a principal and version, alongside constants, rules, scope, and variables.

## Resource Policy

`ResourcePolicy` specifies the resource, version, constants, rules, and more.

## Role Policy

`RolePolicy` contains the role name, parent roles, and associated rules.

## Examples

- **Condition Example**: A condition could check for permissions based on the user role.
- **Principal Policy Example**: A principal policy for managing user roles.
- **Resource Policy Example**: Framework setup for managing different resources with specific permissions.

```json
{
    "apiVersion": "api.cerbos.dev/v1",
    "derivedRoles": {...},
    "principalPolicy": {...},
    "resourcePolicy": {...},
    "rolePolicy": {...}
}
```