Permify is an open-source authorization service that implements fine-grained access control inspired by Google Zanzibar.
The tool addresses the challenge of building scalable permission systems by providing a dedicated service for managing authorization decisions. Rather than embedding access control logic into applications, Permify centralizes authorization through a service that evaluates permissions based on relationships and attributes. It supports multiple authorization models including role-based access control, attribute-based access control, and relationship-based access control, allowing teams to express complex permission rules declaratively and evaluate them consistently across services.
Teams should adopt Permify when they need authorization logic that scales beyond simple role checks and want to avoid reimplementing permission evaluation across multiple services. It suits applications requiring fine-grained access control—such as multi-tenant systems, collaborative platforms, or services with complex permission hierarchies—where authorization decisions depend on relationships between users, resources, and roles. The tool is particularly valuable for organizations building cloud-native or distributed systems where a centralized authorization service can be queried via gRPC, reducing the need to duplicate permission logic in each application.
The project maintains active engagement with its user base, with nearly all open issues originating from external adopters rather than the core team, demonstrating substantial real-world usage. Maintainers respond to new issues and pull requests within hours. Work tracked in the issue system centers on high-priority items, feature requests, and bug fixes.
