## Policy Overview

The Cerbos policy framework allows for fine-grained access control based on dynamic conditions and contexts.

### Key Concepts
- **Derived Roles**: Manage the creation of roles that extend existing roles.
- **Constants**: Define constants used within the policy.
- **Condition**: Define conditions under which rules are evaluated.

### Policy Structure
Below is a brief overview of the essential components of a Cerbos policy:

1. **Metadata**: Store essential information about the policy, such as versioning and annotations.
2. **Principal Policy**: Defines access rules based on user identities and contexts.
3. **Resource Policy**: Defines access rules based on resources being accessed (e.g. databases, files).
4. **Role Policy**: Extends capabilities of roles by defining specific actions and access rules.

### Example of a Principal Policy
```json
{
  "principal": "user@example.com",
  "version": "1.0",
  "rules": [
    {
      "resource": "file",
      "actions": ["read"],
      "allowActions": ["view"]
    }
  ]
}
```

### Role Policy Example
```json
{
  "role": "file_editor",
  "rules": [
    {
      "resource": "*",
      "allowActions": ["edit"],
      "effect": "EFFECT_ALLOW"
    }
  ]
}
```