Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage.

Cerbos Community

image.png

hi team! In derivedRoles we're always initiating based on a parentRole provided by the Principle right..? When further restricting the role assignment using an expression, is there a special var we can use in this expression to refer to the value of the parentRole that's currently being evaluated?

parentRole: banana*
expression: CurrentlyEvaluatedParentRole.EndsWith('pop')

CoPilot tells me there's no such variable exposed at the moment. A new FR was added to expose it: <https://github.com/cerbos/cerbos/issues/2859>

hey, thanks for raising the detailed request. we're going to have a chat internally to see what we can do here.