[metadata]
description: Fine-grained authorization as a service. RBAC, ABAC, and ReBAC for applications, APIs, and AI agents. Policy as code, a no-code editor, and local PDPs.
og:description: Fine-grained authorization as a service. RBAC, ABAC, and ReBAC for applications, APIs, and AI agents. Policy as code, a no-code editor, and local PDPs.
og:image: https://www.permit.io/opengraph-image?c7c5d9b2de25f712
og:image:alt: Permit.io: Runtime Access Control for the AI Era
og:image:height: 630
og:image:type: image/png
og:image:width: 1200
og:title: Permit.io | Runtime Access Control for the AI Era
twitter:card: summary
twitter:description: Fine-grained authorization as a service. RBAC, ABAC, and ReBAC for applications, APIs, and AI agents. Policy as code, a no-code editor, and local PDPs.
twitter:image: https://www.permit.io/opengraph-image?c7c5d9b2de25f712
twitter:image:alt: Permit.io: Runtime Access Control for the AI Era
twitter:image:height: 630
twitter:image:type: image/png
twitter:image:width: 1200
twitter:title: Permit.io | Runtime Access Control for the AI Era
viewport: width=device-width, initial-scale=1

[canonical-links]
https://www.permit.io

[document-links]
ABAC: /abac
AI Access Control Center: /ai-compliance-explorer
AI Access Control: /ai-access-control
About: /about
Access Control Compliance: /ai-compliance
App and API Permissions: /app-and-api-permissions
Audit Logs: https://docs.permit.io/how-to/use-audit-logs/types-and-filtering
Blog: /blog
Book a demo: /demo
CLI: /cli
Coding Agents Gateway: /coding-agents-gateway
Community Slack: https://io.permit.io/slack
Compliance: /solutions/compliance-teams
Contact sales: /demo
Customers: /customers
Cybersecurity: /solutions/cybersecurity
Developers: /solutions/developers
Docs: https://docs.permit.io
Elements: /elements
Email: mailto:help@permit.io
FAQ's: /pricing#faqs
Finance: /solutions/finance
Get Started: https://app.permit.io/
GitHub: https://github.com/permitio
Government: /solutions/government
Healthcare: /healthcare
Identity: /solutions/identity-teams
Insurance: /solutions/insurance
LinkedIn: https://www.linkedin.com/company/permitio/
MCP Gateway: /mcp-gateway
New Permit Nexus PDP benchmarks: 5.6 ms P99 on RBAC checks, measured server-side Nexus PDP: 5.6 ms P99 RBAC checks See the benchmarks: /nexus-pdp#benchmarks
Nexus PDP: /nexus-pdp
Open Source: /open-source
Open the policy editor: https://app.permit.io/
Or explore the docs: https://docs.permit.io
PBAC: /pbac
Permit.io: /
Policy Engine: https://docs.permit.io/overview/how-does-it-work
Pricing: /pricing
Privacy Policy: /legal/privacy-policy
Product: /solutions/product-teams
RBAC: /rbac
ReBAC: /rebac
Read the architecture: https://docs.permit.io
Read the docs: https://docs.permit.io
Review our security program in the Trust Center →: /trust
Security: /solutions/security-teams
See the benchmarks: /nexus-pdp#benchmarks
Service Status: https://permit-io.instatus.com/
Slack: https://io.permit.io/slack
Start building: https://app.permit.io/
Start with RBAC: /rbac
Talk with our engineers: https://io.permit.io/slack
Talk with us: https://io.permit.io/slack
Terms & Conditions: /legal/terms-and-conditions
Trust Center: /trust
Trust: /trust
Videos: /videos
X: https://x.com/permit_io
YouTube: https://www.youtube.com/@permitio
https://github.com/permitio/opal

[structured-data]
{"@context":"https://schema.org","@graph":[{"@type":"Organization","description":"Fine-grained authorization as a service. RBAC, ABAC, and ReBAC for applications, APIs, and AI agents. Policy as code, a no-code editor, and local PDPs.","name":"Permit.io","sameAs":["https://github.com/permitio","https://x.com/permit_io","https://www.linkedin.com/company/permitio/"],"url":"https://www.permit.io"},{"@type":"SoftwareApplication","applicationCategory":"DeveloperApplication","description":"Fine-grained authorization as a service. RBAC, ABAC, and ReBAC for applications, APIs, and AI agents. Policy as code, a no-code editor, and local PDPs.","name":"Permit.io","operatingSystem":"Cloud","slogan":"Runtime Access Control for the AI Era","url":"https://www.permit.io"}]}

[page-chrome]
Permit.io
Products
Solutions
Developers
Resources
Trust
Pricing
Get Started
Book a demo
Permit.io
Runtime Access Control for the AI Era
GitHub
Slack
X
YouTube
LinkedIn
Products
App and API Permissions
Nexus PDP
MCP Gateway
Coding Agents Gateway
AI Access Control
Elements
Pricing
Solutions
Finance
Insurance
Healthcare
Government
Cybersecurity
RBAC
ABAC
ReBAC
PBAC
Access Control Compliance
Teams
Developers
Security
Compliance
Identity
Product
Developers
Docs
Policy Engine
Audit Logs
CLI
Open Source
Service Status
Resources
Blog
AI Access Control Center
Customers
Videos
FAQ's
Company
About
Trust Center
Contact sales
Community Slack
Email
Privacy Policy
Terms & Conditions
SOC 2 Type II attested
HIPAA BAA available
GDPR
CCPA
CNCF Silver Member
©
2026
Permit Inc.

[content]
Permit.io | Runtime Access Control for the AI Era
New
Permit Nexus PDP benchmarks: 5.6 ms P99 on RBAC checks, measured server-side
Nexus PDP: 5.6 ms P99 RBAC checks
See the benchmarks
Loading
Runtime Access
Control
for the AI Era.
Fine-grained authorization as a service —
for applications, APIs, and AI agents.
Policy as code, a no-code editor, and local PDPs. Used by teams shipping permissions in enterprise, fintech, healthcare, and government.
Start building
Talk with our engineers
Start building
Talk with us
Shipped by developers at the world's leading
products
SOC 2 Type II attested
Security, Availability, Confidentiality
Cloud, hybrid, or on-prem
Decisions run in your network
Every decision logged
Explained, and forwardable to your SIEM
Built on open standards
OPA, Cedar, and OPAL
Review our security program in the Trust Center
→
Stop rebuilding permissions in application code
Most products start with a roles table and a pile of if statements. Then tenants show up. Then attributes. Then relationship graphs. Then agents acting on behalf of users.
Fine-grained authorization is infrastructure — RBAC, ABAC, and ReBAC with an audit trail — not a feature you rewrite every quarter.
Role explosion
:
Static roles cannot express tenancy, ownership, or context without multiplying forever.
Checks in code
:
if/else authorization cannot be reviewed by security, reused by agents, or proven in an audit.
Missing models
:
ABAC and ReBAC get bolted on too late, after the roles table has already calcified.
New subjects
:
Services and AI agents need the same policy as users — not a second permission system.
Book a demo
Talk with our engineers
Authentication says who. Permit decides what.
Keep your identity provider for sign-in. Permit is the authorization layer behind it: a policy decision point that answers one question for every human, service, and agent, and logs why.
How a permission decision is made
Identity
A human, service, or AI agent, authenticated by your identity provider.
Request
Can this identity perform this action on this resource, right now?
Policy decision point
Evaluates RBAC, ABAC, and ReBAC policy with OPA or Cedar, in your network.
Decision
Allow or deny, returned to your code with the reason attached.
Audit
Every decision logged, explained, and forwardable to your SIEM.
Example decision
allow
subject
agent:invoice-assistant for user:dana@example.com
action
approve
resource
invoice:8841 (tenant: example-co)
reason
dana is finance-approver on example-co; amount 4,200 is under her 10,000 limit
decided by
PDP in your VPC
The same five steps apply whether the caller is a person clicking a button or an agent calling a tool. Only the identity changes.
Talk with our engineers
Book a demo
RBAC, ABAC, and ReBAC.
One check API.
Fine-grained authorization is a set of models, not a roles table. Start with RBAC, add attributes when context matters, model relationships when the graph matters. Humans, services, and agents hit the same policy engine.
RBAC
Role-based access
Roles mapped to actions on resource types. Start here, then layer tenancy, conditions, and relationships without changing your check API.
ABAC
Attribute-based access
ReBAC
Relationship-based access
Example policy
“
Banker can Approve Loan
”
Start with RBAC
Open the policy editor
RBAC
·
Policy UI
Policy as code
Policy UI
When an agent calls a tool, it is still a subject, an action, and a resource.
MCP Gateway
applies the same RBAC, ABAC, and ReBAC policies at the edge — it does not invent a second permission system.
Authorization as infrastructure
Policy UI + policy as code:
the whole team can edit permissions; Git still owns the source of truth.
Local PDP:
OPA or Cedar in your VPC, updated by OPAL, decisions next to the workload.
Any model:
RBAC, ABAC, and ReBAC in one engine — not three products to stitch together.
Any subject:
users, services, and agents evaluated with the same check API.
Permit.io is the control, data, and enforcement plane — not a dashboard in front of someone else's PDP. Author policy in the editor or Git, keep users, roles, and relationships in the graph, and enforce every check locally. Same stack for the software you already ship and the agents you add to it.
Read the architecture
Talk with our engineers
The same policies follow agents
to every tool they call.
Put the MCP Gateway URL in front of an upstream server and enforce the same RBAC, ABAC, and ReBAC graph you already use in APIs and data. One policy plane — session, service, row.
One agent action, four enforcement points
AI agent
acting for a person
MCP gateway
May this agent call this tool, with these arguments?
policy check
API gateway
May this delegated token reach this endpoint?
policy check
Application
May this user approve this record in this tenant?
policy check
Database
May this query read this column?
policy check
Each layer asks its own question of the same policy and the same identity. A prompt injection that slips past one check still meets the next.
Gateway
Identify the agent, bind human delegation, and authorize each tool call against policy — not a standing API key.
Application
Enforce the same fine-grained policy in APIs and services with a low-latency PDP next to the workload.
Data
Push the decision down to queries, rows, and columns so an allowed tool call still cannot over-read.
The gateway applies the same
fine-grained authorization
as your APIs — RBAC, ABAC, and ReBAC on each tool call, not a second permission system.
Start building
Book a demo
Talk with our engineers
Delegate access. Bind it to intent. Enforce it at runtime.
Agents are first-class subjects in the same policy model. You delegate a human's permissions, scope them with attributes and relationships, and re-check every action — including when prompt injection tries to change the job.
Human delegation
Bring your own IdP. Grant an agent a subset of a user's permissions — never a standing god key.
Scoped permissions
Map trust to real FGA: read-only exploration, a single tenant, a relationship on a record, a write that needs approval.
Intent check
Interrogate the agent at the gateway. If the requested action drifts from the delegated intent, deny it.
Runtime policy
Evaluate identity, attributes, relationships, and context at decision time — the same PDP path as any other request.
Keep your IdP. Add authorization.
Authentication stays where it is. Permit.io is the missing layer: fine-grained authorization as a service — SDKs, CLI, Terraform, GitOps, and a PDP beside your code.
Distributed:
Decisions happen in-VPC at the edge.
Fast:
Low-latency decisions from a PDP running next to your services.
Flexible:
RBAC, ABAC, and ReBAC out of the box.
Open:
Built on OPA, Cedar, and OPAL.
Works with your identity provider, gateways, APIs, cloud, and policy engines. Managed or self-hosted. Hybrid by design — including when the caller is an agent.
Read the docs
Talk with our engineers
Developers first. The rest of the company can finally help.
Developers
SDKs, APIs, Terraform, GitOps, and a local PDP. Policy as code you can review in a pull request — including when the subject is an agent.
Architects
One authorization plane across apps, APIs, data, and MCP. RBAC, ABAC, and ReBAC without stitching point products.
Security & IAM
Least privilege, human delegation, decision traces, and a path to AI features that does not bypass the policy you already wrote.
Product & ops
A no-code policy editor, embedded Elements, and approval flows so support and customers can manage access without a deploy.
Watch the decisions, not just the logs
Monitor
Agents that watch authorization decisions and audit logs.
Detect
Spot anomalies static roles miss — including agent drift.
Recommend
Propose tighter policies back into the same GitOps flow.
Start building
Book a demo
Talk with our engineers
Control, data, and enforcement in one stack
Authorization is more than a yes/no. Permit.io is the control, data, and enforcement plane: you author policy in the editor or Git, users, roles, and relationships live in the graph, and a local PDP enforces every check — from the API call to the row, including the agent tool call in between.
One platform for application permissions and agent permissions. Same models. Same check. Same logs.
RBAC, ABAC, and ReBAC
Policy as code
Embedded approval & access UIs
Audit logs & decision traces
Hybrid PDP deployment
Apps, APIs, agents, and data
Around the decision
Elements, GitOps, and audit in one flow
Embed user management, approval flows, and audit logs in your product. Manage policy in Git. Propagate every decision to the logger you already use.
Book a demo
Talk with our engineers
Trusted where access control is mission-critical
From regulated workloads to high-scale product platforms, Permit.io is the authorization layer developers put in front of apps, APIs, and agents — without giving up speed, control, or where the PDP runs. Built for production scale, with every decision made next to your services.
Nexus PDP, measured
P99, RBAC check
5.6 ms
P99, 3-hop ReBAC
11.3 ms
RBAC checks per 2 CPU pod
658/s
Server-side latency on one 2 CPU pod, on a beta build.
See the benchmarks
SOC 2 Type II
HIPAA / GDPR / CCPA
Low-latency PDP
Hybrid deployment
GitOps-ready
Fine-grained policy
Human-to-agent delegation
High availability
Book a demo
Talk with our engineers
Never build permissions again
Fine-grained authorization for your application, your APIs, and your agents.
RBAC, ABAC, and ReBAC — as a service.
Ship faster —
without hiding access control in code.
Start building
Book a demo
Talk with our engineers
Or explore the docs
