Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team Y edit. It keeps those rules in one place, apart from the application code that would otherwise carry them.
Permify follows the design of Google Zanzibar, the authorization system Google runs across its own products. Teams reach for something like it when permissions get specific and start nesting inside each other, and when the same rules have to hold across several applications at once.
You write permission rules in Permify’s own language, which covers role-based access control, relationship-based rules, and attribute-based ones. A relationship-based rule grants access through a connection: the owner of a document, a member of the team that owns it.
The service can also hold a separate set of rules for each tenant, so one deployment serves many customer organizations without their permissions bleeding together. Permify answers checks in tens of milliseconds.
A single Docker command starts it locally, listening for REST and gRPC calls and keeping authorization data in memory. Permify is a member of the Cloud Native Computing Foundation, and the repository lists bounty-labeled issues that pay out on accepted pull requests.
Permify is available for free on GitHub.
Must read:
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
