Permify
title: Permify radar_quadrant: Platforms radar_ring: Assess radar_position: center created: 2026-05-22 last_updated: 2026-05-22 related: ["CloudflareWorkers", "Temporal", "SecureByDesign"]
Permify is an open-source authorization service inspired by Google Zanzibar, the globally consistent access control system underlying Google Drive, YouTube, and other Google products. It centralizes authorization logic into a standalone gRPC/REST service, separating permission enforcement from application code.
Permify supports three access control paradigms through a single domain-specific language:
- RBAC (role-based): users have roles, roles have permissions
- ReBAC (relationship-based): permissions derived from relationships between entities (e.g., "user X is owner of document Y, therefore can edit it")
- ABAC (attribute-based): conditions based on entity attributes
The DSL allows composing these paradigms in one policy. A single can user X perform action on resource Y? check resolves across all defined relationships and rules.
Permify runs as a standalone service, accessed via:
- REST API on port 3476
- gRPC API on port 3478
Data is stored in a configurable backend (in-memory for development, Postgres for production). Relationships between entities are written to Permify's store; authorization checks query the relationship graph at runtime.
Load testing recorded 10–21ms average latency under 10,000 requests per second with 1,000 virtual users and 0% request failures.
docker run -p 3476:3476 -p 3478:3478 ghcr.io/permify/permify servePermify was acquired by FusionAuth in 2026. The open-source model and independent development trajectory are uncertain post-acquisition. Reassess if licensing changes or the repository becomes unmaintained.
Permify sits at Platforms → Assess center. Fine-grained authorization (beyond simple role checks) is a recurring architectural pain point, and Permify is the leading open-source Zanzibar implementation — stronger in maturity and performance than alternatives like Casbin or OPA for relationship-based scenarios. The FusionAuth acquisition in 2026 introduces uncertainty over the open-source model and development trajectory, reducing conviction from inner to center. The technology remains sound but the governance risk is real. Hold is the outcome if licensing changes or maintenance stalls. Trial gate: an authorization policy defined and serving real permission checks in a project.
