Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage.

Cerbos Community

No. Principal policies are for overriding rules for particular users.

Just trying to understand Principal policies better.

I think I won't be writing Principal policies. I derive all my identities from JWTs and attr key/value pairs. So Principal policies don't make sense for my use cases.

I wouldn't want a specific User-X to have overriding rules.

Makes sense. Principal policies are mostly for exceptional cases like giving an auditor temporary access.

Exactly what I was thinking as well. A regulatory / oversight body is a good fit for this feature. Thank you.