A forbid policy is an explicit authorization rule that denies a matching request. In Cedar, it acts as a security guardrail: a matching forbid overrides any permit, while requests without an effective permit remain denied. section 7.2.1 section 7.3.3
Cedar combines applicable policies using three practical rules:
- A true forbid produces Deny, regardless of matching permits. section 7.3.3
- A true permit produces Allow only when no applicable forbid matches. section 7.3.3
- No applicable permit produces Deny by default. section 9.3.3
- Foundational teams can enforce universal constraints without depending on policy order or application-specific permissions. section 15.3.4
Blocking unsafe access to critical resources
A policy can forbid every action on critical resources unless the device reports a Secure posture and an overall security assessment of at least 80. This blocks access even when another policy would otherwise permit it. section 1.4.1
forbid(
principal,
action,
resource in Category::"CriticalResources"
) unless {
context.device.security.risk == "Secure" &&
context.device.security.assessment.overall >= 80
};
Use the Cedar policy listing to inspect how an exception-based forbid expresses device security requirements directly in policy code. section 1.4.1
Forbid policies also protect delegated authority. A guardrail can deny requests when the principal is not the named delegate, while a separate permit limits actions, resources, and validity time. section 18.6.3
