# Cerbos policies

There are six kinds of Cerbos policies:

## [Derived roles](https://docs.cerbos.dev/cerbos/prerelease/policies/derived_roles)

Traditional RBAC roles are usually broad groupings with no context awareness. Derived roles are a way of augmenting those broad roles with contextual data to provide more fine-grained control at runtime. For example, a person with the broad `manager` role can be augmented to `manager_of_scranton_branch` by taking into account the geographic location (or another factor) and giving that derived role bearer extra privileges on resources that belong to the Scranton branch.

## [Resource policies](https://docs.cerbos.dev/cerbos/prerelease/policies/resource_policies)

Defines rules for actions that can be performed on a given resource. A resource is an application-specific concept that applies to anything that requires access rules. For example, in an HR application, a resource can be as coarse-grained as a full employee record or as fine-grained as a single field in the record.

## [Principal policies](https://docs.cerbos.dev/cerbos/prerelease/policies/principal_policies)

Defines overrides for a specific user.

## [Role policies](https://docs.cerbos.dev/cerbos/prerelease/policies/role_policies)

Define rules specific to a given role. Rules are defined as a list of allowable actions that apply to a particular resource.

## [Exported variables](https://docs.cerbos.dev/cerbos/prerelease/policies/variables#export)

Defines variables to be reused in condition expressions in other policies.

## [Exported constants](https://docs.cerbos.dev/cerbos/prerelease/policies/variables#export-constants)

Defines constants to be reused in condition expressions in other policies.

Policies are evaluated based on the metadata passed in the request to the Cerbos PDP. See [Cerbos API](https://docs.cerbos.dev/cerbos/prerelease/api/) for more information.

View the latest documentation and example requests by accessing a running Cerbos instance using a browser ( [http://localhost:3592/](http://localhost:3592/)). The OpenAPI (Swagger) schema can be obtained by accessing `/schema/swagger.json` as well.