Permify

Permify moves access control out of your codebase into a service of its own. Rather than permission checks scattered through application logic, one system answers questions such as whether user X can view document Y, or which posts the members of team Y may edit, and answers them in tens of milliseconds.

The design follows Google Zanzibar, the consistent global authorization system behind Google's own products. Permissions are written in a domain specific language compatible with RBAC, ReBAC and ABAC, and a hosted playground lets you build the logic and test it against sample data before wiring anything in.

A handful of properties define what the service gives you.

• Centralized logic: reason about, test and debug authorization as a single entity.
• Granular permissions: express resource-specific, hierarchical and context aware rules.
• Multi-tenancy: give each vendor or organization isolated logic, managed from one place.
• Two interfaces: a REST API on port 3476 and a gRPC service on port 3478.
• Load tested: a run at 1000 virtual users returned no failed requests, with median latency around 15 milliseconds.

One Docker command starts the server with authorization data held in memory, and a health check endpoint confirms it is up. The self-hosted Community Edition is published four times a year and leaves observability dashboards and data synchronization to the paid cloud. Readers should also know that Permify has been acquired by FusionAuth.