---
title: "Basic rules"
description: "How to write policy rules in Calico Open Source — label selectors, source and destination match criteria, and rule actions."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico/latest/network-policy/policy-rules/policy-rules-overview"
---

# Basic rules

## Big picture

Use Calico policy rules and label selectors that match Calico endpoints (pods, OpenStack VMs, and host interfaces) to define network connectivity.

## Value

Using label selectors to identify the endpoints (pods, OpenStack VMs, host interfaces) that a policy applies to, or that should be selected by policy rules, means you can define policy without knowing the IP addresses of the endpoints. This is ideal for handling dynamic workloads with ephemeral IPs (such as Kubernetes pods).

## How to

Read [Get started with Calico policy](https://docs.tigera.io/calico/latest/network-policy/get-started/calico-policy/calico-network-policy.md) and [Kubernetes policy](https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-policy/kubernetes-network-policy.md), which cover all the basics of using label selectors in policies to select endpoints the policies apply to, or in policy rules.

## Additional resources

- [Global network policy](https://docs.tigera.io/calico/latest/reference/resources/globalnetworkpolicy.md)
- [Network policy](https://docs.tigera.io/calico/latest/reference/resources/networkpolicy.md)