🔐 New: A CISO’s benchmark for authorization maturity ➔ Download the ebook

Derived roles

Harness the power of context-driven roles with Cerbos. Adapt to real-time changes and ensure precise access controls tailored to each user's unique situation.

What are derived roles?

Derived roles are dynamic roles granted to a principal for the scope of a single request based on specific conditions or contexts, rather than being statically assigned. They allow for more granular and adaptive access controls, by deriving roles from attributes like user behaviour, time of day, location, or any other contextual information.

Adaptive, precise and efficient

• Dynamic adaptation: Instead of relying on static roles, Cerbos adjusts access controls in real-time based on the prevailing context, ensuring accurate and adaptive authorization.
• Reduce repetition: Business logic for common scenarios and conditions can be defined once in a derived role, then re-used across different resource policies.

Sample derived policy

apiVersion: api.cerbos.dev/v1
derivedRoles:
 name: common_roles
  definitions:
    - name: OWNER
      parentRoles: ["USER"]
      condition:
        match:
          expr: request.resource.attr.ownerId == request.principal.id

A derived role of OWNER is granted to the principal for the scope of the check, in the case where the ownerId attribute of the resource is equal to the id of the principal making the request (ie they are the owner).

Find out more

Features, benefits & use cases

Fit Cerbos seamlessly into your tech stack

Explore further

Playground

Prototype policies in your browser right now

Try the Playground

Cerbos Hub

Implement roles & permissions in your app

Get started now

Speak to an engineer

Book an intro call and learn more

Book a meeting

Subscribe to our newsletter

Join thousands of developers | Features and updates | 1x per month | No spam, just goodies.

Subscribe to our monthly newsletter