A policy override adds a local exception beside an existing authorization rule rather than changing the shared rule itself. It suits cases where a customer, workspace, or project needs stricter or more permissive access than the standard template allows. For example, a customer may forbid all sharing, or a project may grant an external contractor temporary editing rights. section 9.7.2
Use overrides when the exception is local and deliberate:
- Scope the exception to a particular resource, workspace, or customer instead of applying it organization-wide. section 9.7.2
- Keep the template-generated policy unchanged, preserving its consistency for other resources. section 9.7.2
- Distinguish overrides from global constraints: overrides express delegated local decisions, while global constraints enforce central guardrails everywhere. section 9.7.2
- Label overrides clearly, such as with an #override tag, so reviewers can locate and audit exceptions in the policy store. section 9.7.2
Restricting a sensitive workspace
A document-view template normally lets an owner's readers team view documents. An override can forbid viewing in the legal-review workspace unless the requester is the owner, tightening access without altering the global template. section 9.7.2
// added to #override document-view-template to restrict legal workspace
forbid(
principal is ACME::Employee,
action == ACME::Action::"doc:view",
resource is ACME::Document::"workspace:legal-review"
)
when { resource.owner != principal };
This Cedar policy demonstrates a resource-scoped override: it forbids document viewing in one workspace whenever the principal is not the owner. section 9.7.2
