Policy.schema.json

Policy Overview

The Cerbos policy framework allows for fine-grained access control based on dynamic conditions and contexts.

Key Concepts

• Derived Roles: Manage the creation of roles that extend existing roles.
• Constants: Define constants used within the policy.
• Condition: Define conditions under which rules are evaluated.

Policy Structure

Below is a brief overview of the essential components of a Cerbos policy:

1. Metadata: Store essential information about the policy, such as versioning and annotations.
2. Principal Policy: Defines access rules based on user identities and contexts.
3. Resource Policy: Defines access rules based on resources being accessed (e.g. databases, files).
4. Role Policy: Extends capabilities of roles by defining specific actions and access rules.

Example of a Principal Policy

{
  "principal": "user@example.com",
  "version": "1.0",
  "rules": [
    {
      "resource": "file",
      "actions": ["read"],
      "allowActions": ["view"]
    }
  ]
}

Role Policy Example

{
  "role": "file_editor",
  "rules": [
    {
      "resource": "*",
      "allowActions": ["edit"],
      "effect": "EFFECT_ALLOW"
    }
  ]
}