--- title: "Role policies with Cerbos" description: "Author permissions from a role’s point of view, not just the resource, and enforce least privilege by default." canonical: "https://www.cerbos.dev/features-benefits-and-use-cases/role-policies" source: "https://www.cerbos.dev/features-benefits-and-use-cases/role-policies" --- # Role policies with Cerbos Author permissions from a role’s point of view, not just the resource, and enforce least privilege by default. ## Understanding role policies Role policies in Cerbos provide a structured approach to defining permissions based on orientations around a role that can be assigned to a user or a non-human identity. They allow teams to specify which actions a particular role can perform on various resources, facilitating clear and manageable access control without having to augment the underlying resource policies. During access checks, Cerbos evaluates role policies that match the principal's role and scope first. If multiple role policies apply, their permissions are combined, and then this is used as a permission-narrowing mechanism to limit which actions on resources are allowed. ### Precision and enhanced security - **Role-centric definition:** Permissions are grouped by role, specifying what actions that role can perform on various resources, and removing the need for new roles to be added to the resource policies. - **Inheritance and narrowing:** Role policies inherit from parentRoles. These parents can be roles defined in an Identity Provider (IdP) or other role policies within Cerbos. A role policy can only _narrow_ the permissions granted by its parentRoles. It cannot grant permissions that are not already allowed by the parents. - **Scope-aware:** Role policies are inherently scope-aware. A role policy defined with a scope attribute will only apply to principals acting within that specific tenant context. - **Implicit deny:** Actions not explicitly listed in allowActions within a matching rule are implicitly denied for that rule. The policy as a whole represents an exhaustive view of what is allowed on that resource. ## Dive deeper into role policies - [Advanced multi-tenant SaaS authorization with Cerbos](https://www.cerbos.dev/blog/multi-tenant-saas-authorization-role-policies-and-scoped-resource-policies) — Role policies and scoped resource policies - [Empower your SaaS platform with robust, policy-enforced multi-tenancy](https://www.cerbos.dev/features-benefits-and-use-cases/multi-tenant-saas) — Ensuring controlled, audited, and isolated environments for each tenant - [Community insights on role policies](https://community.cerbos.dev/?_gl=1*5ozo82*_ga*MTk1NjcwNzQ1MC4xNjY2Mjc5NjI2*_ga_8G3G3MS838*MTY5NDE5MTE5Ny41MjcuMS4xNjk0MTkyNzgyLjIwLjAuMA) — Engage with the Cerbos community, learning from real-world role-policies scenarios