Permify/permify

Health v2 · maintenance only

Adoption not part of the score

5940 stars · 324 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Permify is an open-source authorization-as-a-service inspired by Google Zanzibar, providing a permission database and policy decision point for fine-grained access control (RBAC, ABAC, ReBAC). It exposes Check and Bulk Check APIs via gRPC and REST, with SDKs for multiple languages, and is now maintained under FusionAuth after acquisition.

Use cases

• implement fine-grained access control for my app
• self-host a Zanzibar-style authorization service
• centralize permissions across microservices
• check if a user can perform an action via API
• model RBAC and ReBAC relationships
• store authorization data in my own database
• batch permission checks for large datasets

When to choose

• you need scalable, fine-grained authorization (ReBAC/RBAC/ABAC) as a dedicated service
• you want a self-hosted, open-source Zanzibar alternative with gRPC/REST APIs
• you want to decouple authorization logic from application codebases

When to avoid

• you only need simple role-based checks that your web framework's middleware can handle
• you require a vendor with long-term independent support, given the FusionAuth acquisition and AGPL-3.0 license
• you need a lightweight in-process policy library rather than a standalone service

Facets

service · maturity maintenance

authorization auth api-framework rpc database security security backend apis developer-tools self-hosted self-hosted cloud go cross-platform zanzibar fga rebac rbac abac access-control permissions grpc authorization-as-a-service policy-engine docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Permify/permify")