A policy effect states the outcome produced when a policy applies: it either permits or forbids an action. Together with scope and conditions, it forms the policy contract that determines who may perform which action on which resource, and under what circumstances. section 7.2 section 7.2.1
Use the effect to distinguish the policy’s decision contribution:
- Permit grants access when the policy’s scope matches and its conditions are satisfied. section 7.2.1
- Forbid denies access, and an applicable forbid overrides an applicable permit. section 7.2.1 section 7.6
- Effect supplies the outcome, while scope identifies the principal, action, and resource and conditions add contextual logic. section 7.2.4
Managed-device document access
A permit policy can allow an employee to view or edit a document they own when using a managed device. A separate forbid policy can block access to confidential documents from unmanaged devices, overriding a permit that would otherwise apply. section 7.2.1 section 7.2.4
Figure 7.1 A complete Cedar policy showing effect (top box), scope (middle box), and conditions (bottom box)
Inspect the complete policy structure: the effect appears first, followed by scope and contextual conditions. section 7.2.4
