Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.cedarai.com/llms.txt

Use this file to discover all available pages before exploring further.

This page explains the conceptual model of policies and roles. To create and manage roles in practice, use the Admin Portal Roles page.

​
What is a policy?

Policies attach to resources and bind members to roles, with optional conditions. 
{
  "bindings": [
    { "role": "roles/inventory.equipmentAdmin", "members": ["group:cedxadmins"] },
    {
      "role": "roles/inventory.equipmentViewer",
      "members": ["user:nancy@cedx.rail", "user:steven@cedx.rail"],
      "condition": {
        "description": "Only can view BNSF cars",
        "expression": "resource.equipmentInitial == 'BNSF'"
      }
    }
  ]
}
IAM policy

​
Roles

  • Predefined roles (examples):
    • roles/inventory.equipmentViewer
    • roles/inventory.equipmentAdmin
    • roles/inventory.equipmentOrderer
  • Feature sets: the columns of the Admin Portal IAM matrix. Each one grants a whole product feature in a single click, and Cedar keeps them current as features evolve, so your roles don’t drift.
  • Custom roles: build a role tailored to your org. Prefer composing it from feature-set columns — that way Cedar’s ongoing curation flows through automatically.

​
Inheritance

Grant at an organization/site/operator level → inherited by terminals, groups/tracks, and resources beneath. Grant at a terminal/group/track or a specific resource for fine‑grained control. A role can also inherit from another role: it picks up every ability of its parents. Cedar uses this so feature sets flow into predefined roles, which means new capabilities Cedar adds to a feature show up in your roles automatically.

​
Manage in the Admin Portal

Roles

View built-in roles and create custom roles

Feature Sets

The columns of the IAM matrix — Cedar curates them so your roles stay current

Bindings

Connect groups to roles (this is how policies are created)

User Groups

Organize users to assign roles at scale