---
title: "Derived roles"
description: "Harness the power of context-driven roles with Cerbos. Adapt to real-time changes and ensure precise access controls tailored to each user's unique situation."
canonical: "https://www.cerbos.dev/features-benefits-and-use-cases/derived-roles"
source: "https://www.cerbos.dev/features-benefits-and-use-cases/derived-roles"
---

# Derived roles

Harness the power of context-driven roles with Cerbos. Adapt to real-time changes and ensure precise access controls tailored to each user's unique situation.

## What are derived roles?

Derived roles are dynamic roles granted to a principal for the scope of a single request based on specific conditions or contexts, rather than being statically assigned. They allow for more granular and adaptive access controls, by deriving roles from attributes like user behaviour, time of day, location, or any other contextual information.

### Adaptive, precise and efficient
- **Dynamic adaptation:** Instead of relying on static roles, Cerbos adjusts access controls in real-time based on the prevailing context, ensuring accurate and adaptive authorization.
- **Reduce repetition:** Business logic for common scenarios and conditions can be defined once in a derived role, then re-used across different resource policies.

### Sample derived policy

```yaml
apiVersion: api.cerbos.dev/v1
derivedRoles:
 name: common_roles
  definitions:
    - name: OWNER
      parentRoles: ["USER"]
      condition:
        match:
          expr: request.resource.attr.ownerId == request.principal.id
```

A derived role of OWNER is granted to the principal for the scope of the check, in the case where the ownerId attribute of the resource is equal to the id of the principal making the request (ie they are the owner).

## Master derived roles with Cerbos

- [Derived roles documentation](https://docs.cerbos.dev/cerbos/latest/policies/derived_roles.html) — Understand the intricacies of crafting and managing derived roles with our guide
- [Community discussions](https://community.cerbos.dev/?_gl=1*5ozo82*_ga*MTk1NjcwNzQ1MC4xNjY2Mjc5NjI2*_ga_8G3G3MS838*MTY5NDE5MTE5Ny41MjcuMS4xNjk0MTkyNzgyLjIwLjAuMA) — Engage with the Cerbos community to explore innovative use cases and best practices for derived roles