Skip to main content

Permit Strength Points

Use this checklist to compare Permit with a homegrown or alternative authorization system. Each item links to the docs that describe how it works.

Policy Builder (UI/API/SDK/IaC/PaC)​

The Permit Policy Builder lets you define authorization rules in the UI, the API, an SDK, or Terraform. Every policy you create in the UI is generated as code (Rego or Cedar), so you can manage it with GitOps: version control, review, and automation.

  • RBAC (Role-Based Access Control): grant permissions through user roles.
  • ReBAC (Relationship-Based Access Control): grant permissions through relationships between users and resources.
  • ABAC (Attribute-Based Access Control): grant permissions based on user, resource, and environment attributes.

Dynamic Policy Updates​

Permit pushes policy updates to your PDPs through OPAL, its open-source policy administration layer. OPAL is event-driven, so policy changes reach every PDP without application restarts or manual steps.

Fully Event-Driven Data Updates​

OPAL also syncs the data your policies need. You define data sources centrally, and OPAL pushes updates to every policy decision point (PDP), so each PDP evaluates checks locally against current data.

Stateful or Stateless Flexibility​

Choose how your PDPs get authorization data:

  • Stateless mode: pass the data as part of the check input.
  • Stateful mode: sync data from one or more sources into Permit ahead of time, so decisions use preloaded context.

Data Plane Segregation from Control Plane​

Permit separates the centralized control plane, where you manage policy, from the distributed data plane, where PDPs make decisions inside your network. Your data can stay on your side, and PDPs scale with your services.

Custom Data Modelling & Schema​

Define your own authorization data model:

Data Consistency & Low Latency​

The hybrid architecture gives you local decisions and a choice of consistency guarantees:

  • Local decisions: PDPs run next to your services and evaluate checks without a round trip to the Permit cloud. As a sidecar on the same host, checks travel over the loopback interface, so there is no network latency: thousands of checks per second at sub-millisecond latency, and under 10ms at p95 from your application.
  • Hybrid model: centralized policy management with local enforcement.
  • Consistency options on an Edge PDP:
    • Eventual consistency through OPAL's event-driven updates
    • Read-your-own-writes with Send Consistent Updates
    • Data update callbacks that notify your infrastructure when PDP data changes (configuration)

Support for Multiple Authorization Models​

Permit supports these models out of the box:

  • RBAC (Role-Based Access Control)
  • ReBAC (Relationship-Based Access Control)
  • ABAC (Attribute-Based Access Control)
  • PBAC (Policy-Based Access Control): write custom policy as code in Rego or Cedar, and manage it with GitOps or Terraform

Advanced Authorization Queries​

Permit answers more than yes/no checks:

Open Source & Licensing​

The components you deploy are open source:

  • The PDP, SDKs, and OPAL are open-source projects you can inspect and self-host.
  • You keep control of your authorization logic, and your policy lives in your own Git repository.
  • More details: Open-Source Fallback

Compliance, Audit & Security​

Permit records who changed what, and why each decision was made:

  • Decision Logs: human- and machine-readable logs of every authorization decision, with the metadata that explains it.
  • Two Types of Audit Logs:
    • Permit Audit Logs: track changes to your authorization configuration.
    • API Logs: track calls to the Permit API.
  • Authorization for Authorization (AuthZ for AuthZ): control who can change policies.
  • SOC 2 Type II attested: Permit.io holds a SOC 2 Type II attestation covering security, availability, and confidentiality. The report is available under NDA.
  • HIPAA compliant: Permit.io meets HIPAA requirements. You can also keep protected health information out of the control plane entirely by running PDPs in your own network and passing opaque identifiers.

Telemetry & Observability​

Monitor and debug your PDPs:

Backup & Versioning​

  • Git-backed policies: with GitOps, every policy change is versioned in your Git repository, so you can audit and roll back policy.

For the product view, see Permit.io.

Contents

Edit this page

Need help?