# Cerbos policies

There are six kinds of Cerbos policies:

## [Derived roles](https://docs.cerbos.dev/cerbos/0.41.0/policies/derived_roles)
Traditional RBAC roles are usually broad groupings with no context awareness. Derived roles are a way of augmenting those broad roles with contextual data to provide more fine-grained control at runtime. For example, a person with the broad `manager` role can be augmented to `manager_of_scranton_branch` by taking into account the geographic location (or another factor) and giving that derived role bearer extra privileges on resources that belong to the Scranton branch.

## [Resource policies](https://docs.cerbos.dev/cerbos/0.41.0/policies/resource_policies)
Defines rules for actions that can be performed on a given resource. A resource is an application-specific concept that applies to anything that requires access rules. For example, in an HR application, a resource can be as coarse-grained as a full employee record or as fine-grained as a single field in the record.

## [Principal policies](https://docs.cerbos.dev/cerbos/0.41.0/policies/principal_policies)
Defines overrides for a specific user.

## [Role policies](https://docs.cerbos.dev/cerbos/0.41.0/policies/role_policies)
Define rules specific to a given role. Rules are defined as a list of allowable actions that apply to a particular resource.

## [Exported variables](https://docs.cerbos.dev/cerbos/0.41.0/policies/variables#export)
Defines variables to be reused in condition expressions in other policies.

## [Exported constants](https://docs.cerbos.dev/cerbos/0.41.0/policies/variables#export-constants)
Defines constants to be reused in condition expressions in other policies.

Policies are evaluated based on the metadata passed in the request to the Cerbos PDP. See [Cerbos API](https://docs.cerbos.dev/cerbos/0.41.0/api/) for more information.