Control plane / Data plane
Permit splits authorization into two planes:
- Control plane: where you manage authorization. It holds your policy and the identifiers it refers to (user keys, role keys, resource keys, tenant keys), and it runs in Permit's cloud.
- Data plane: where decisions happen. Policy decision points (PDPs) run next to your services, evaluate every check locally, and can read the data your policies need (names, emails, attributes) from sources inside your network.
You get the managed features of the control plane without sending sensitive data to the cloud, unless you choose to.
Hybrid - Decoupling the data plane
Hybrid is the default Permit deployment. The control plane stays in Permit's cloud, and the data plane stays entirely in your network.
The mechanism is OPAL, Permit's open-source policy administration layer. The OPAL server in the control plane pushes policy and data updates to the OPAL client inside each PDP. The PDP's policy engine (OPA or Cedar) then answers checks from that local state.
The control plane can work only with identifiers (for example, unique user IDs), without knowing anything else about the entities behind them. You can store user details such as names in Permit, but it is optional. Keep them in your own systems if privacy or data-residency rules require it.
Local PDP - Policy Decision Point
A PDP is a network node that answers authorization queries using policies and contextual data. The Permit PDP is your authorization microservice, and you deploy it beside your own services.
The PDP is the core of the hybrid architecture. Run it as a sidecar, as a cluster, or as a single instance for light workloads. The Permit PDP bundles OPA, the OPAL client, and an API server, and it is available from Docker Hub.
For more information, see the PDP documentation.