🔐 New: A CISO’s benchmark for authorization maturity ➔ [Download the ebook](https://solutions.cerbos.dev/authorization-maturity-model-a-cisos-benchmark)

# Role policies with Cerbos

Author permissions from a role’s point of view, not just the resource, and enforce least privilege by default.

# Understanding role policies

#### Role policies in Cerbos provide a structured approach to defining permissions based on orientations around a role that can be assigned to a user or a non-human identity. They allow teams to specify which actions a particular role can perform on various resources, facilitating clear and manageable access control without having to augment the underlying resource policies.

#### During access checks, Cerbos evaluates role policies that match the principal's role and scope first. If multiple role policies apply, their permissions are combined, and then this is used as a permission-narrowing mechanism to limit which actions on resources are allowed.

## Precision and enhanced security

- **Role-centric definition:** Permissions are grouped by role, specifying what actions that role can perform on various resources, and removing the need for new roles to be added to the resource policies.
- **Inheritance and narrowing:** Role policies inherit from parentRoles. These parents can be roles defined in an Identity Provider (IdP) or other role policies within Cerbos. A role policy can only _narrow_ the permissions granted by its parentRoles. It cannot grant permissions that are not already allowed by the parents.
- **Scope-aware:** Role policies are inherently scope-aware. A role policy defined with a scope attribute will only apply to principals acting within that specific tenant context.
- **Implicit deny:** Actions not explicitly listed in allowActions within a matching rule are implicitly denied for that rule. The policy as a whole represents an exhaustive view of what is allowed on that resource.

### Find out more

#### Features, benefits & use cases

Fit Cerbos seamlessly into your tech stack

#### Playground

Prototype policies in your browser right now

#### Cerbos Hub

Implement roles & permissions in your app

#### Speak to an engineer

Book an intro call and learn more