When a service must grant many people access to specific documents, a Cedar policy template provides a reusable authorization pattern instead of requiring each policy to be handwritten. It keeps the policy structure fixed while reserving principal and resource values for later linking. section 9.7.1
Use templates selectively and govern their lifecycle:
- Instantiate a template with concrete values for ?principal, ?resource, or both; Cedar does not support arbitrary template parameters such as ?owner or ?readers_team. section 9.7.1
- Prefer relationship data for dynamic sharing such as team membership, ownership, management, and reader groups; reserve templates for explicit repeated grants. section 9.7.1
- Validate linked entity types, tenancy, and existence; record template names and semantic versions, test changes, stage rollouts, and retain auditable links. section 9.7.1
- Keep template ownership central while allowing product teams to supply constrained parameters and overrides for precise local exceptions. section 9.7.1
Direct document viewing
A fixed template can grant document-view permission to a linked principal and resource. Linking it for Alice and document 42 creates an explicit, auditable per-principal, per-resource grant; team-based sharing remains relationship-driven. section 9.7.1
// Template: direct-view-template
permit (
principal == ?principal,
action == ACME::Action::"doc:view",
resource in ?resource
)
Inspect a Cedar template whose reserved slots are filled when the policy is linked to concrete entities. section 9.7.1
