What are derived roles?

Derived roles are dynamic roles granted to a principal for the scope of a single request based on specific conditions or contexts, rather than being statically assigned. They allow for more granular and adaptive access controls, by deriving roles from attributes like user behaviour, time of day, location, or any other contextual information.

Adaptive, precise and efficient

• Dynamic adaptation: Instead of relying on static roles, Cerbos adjusts access controls in real-time based on the prevailing context, ensuring accurate and adaptive authorization.
• Reduce repetition: Business logic for common scenarios and conditions can be defined once in a derived role, then re-used across different resource policies.

Sample derived policy

        
      
      
apiVersion: api.cerbos.dev/v1
derivedRoles:
 name: common_roles
  definitions:
    - name: OWNER
      parentRoles: ["USER"]
      condition:
        match:
          expr: request.resource.attr.ownerId == request.principal.id

A derived role of OWNER is granted to the principal for the scope of the check, in the case where the ownerId attribute of the resource is equal to the id of the principal making the request (ie they are the owner).