Permit.io is the permissions infrastructure for the internet. It is a fullstack authorization solution that enables developers to bake in access control into their code in minutes and be ready for future requirements from customers and regulators.
In order for a BE developer to decide if user A is permitted to see resource B, the developer will call permit SDK and get a clear answer.
Fullstack-Authorization?
At Permit.io, we believe that authorization isn't just about how your software enforces access. It is also about the experiences the dev teams and their users have with the software. For the best experiences, we provide a suite of tools:
Infrastructure - A centralized control panel, SDKs, APIs, and microservices you need to add to create a decision and enforcement points.
Backoffice - A set of (no-)code tools that the rest of the team (e.g., product, security, support, sales) needs to support the product. We empower developers so they can easily empower the rest of their team.
Interfaces - A complete UI solution for your end-users.
When combining all three layers, you get Permit.io. Permit.io delivers an end-to-end solution, covering all access-control needs so that you won't have to build anything.
Permit.io vs OPAL?
A key part of Permit.io's infrastructure is the open-source combo of OPA and OPAL.
OPA, or Open Policy Agent is a generic policy-based decision engine
OPAL, or Open Policy Administration Layer, is a real-time solution to keep policy agents updated with the policies and data they need in an event-driven distributed fashion.
When you use Permit.io's authorization microservices you get OPA and OPAL as a built-in default.
Realtime Permissions?
Consider a simple policy like - "Only users that have paid for a feature should have access to it". The information on who has paid would usually be managed by a third party service, such as Stripe or Paypal. We'd want that changes in these services to update our authorization layer as soon as possible, so they can change access accordingly. OPAL provides this through its event driven architecture.
Comments and Reviews
Probably the best platform for application-level authorization. They have the best-in-class SDK for enforcement and decision making. Together with their slick UI for configuration and audit, it is the best product out there.