Understanding role policies

Role policies in Cerbos provide a structured approach to defining permissions based on orientations around a role that can be assigned to a user or a non-human identity. They allow teams to specify which actions a particular role can perform on various resources, facilitating clear and manageable access control without having to augment the underlying resource policies.

During access checks, Cerbos evaluates role policies that match the principal's role and scope first. If multiple role policies apply, their permissions are combined, and then this is used as a permission-narrowing mechanism to limit which actions on resources are allowed.

Precision and enhanced security

• Role-centric definition: Permissions are grouped by role, specifying what actions that role can perform on various resources, and removing the need for new roles to be added to the resource policies.
• Inheritance and narrowing: Role policies inherit from parentRoles. These parents can be roles defined in an Identity Provider (IdP) or other role policies within Cerbos. A role policy can only narrow the permissions granted by its parentRoles. It cannot grant permissions that are not already allowed by the parents.
• Scope-aware: Role policies are inherently scope-aware. A role policy defined with a scope attribute will only apply to principals acting within that specific tenant context.
• Implicit deny: Actions not explicitly listed in allowActions within a matching rule are implicitly denied for that rule. The policy as a whole represents an exhaustive view of what is allowed on that resource.