Permify

What it is

Permify is an open-source authorization engine modeled on Google's Zanzibar paper — the same relationship-based access control (ReBAC) approach that powers Google Drive and YouTube permission checks. It runs as a standalone service (gRPC/REST) that your application calls to answer "can user X do action Y on resource Z?" You define a schema (Permify DSL) describing relationships between entities — users, roles, resources, hierarchies — and Permify computes authorization decisions against a relationship graph, with support for RBAC, ABAC, and ReBAC patterns in one model.

It's categorized as Provisioning here because it's infrastructure you deploy and operate, not a SaaS decision API you just call — though a hosted option exists.

Who builds it and why

Built by Permify Inc., a company formed specifically around productizing Zanzibar-style authorization for teams that don't want to build their own relationship-based permission engine from scratch. The core pitch: every company hits the same wall — role-based access control (RBAC) breaks down once you need resource-level, hierarchical, or context-dependent permissions (think Notion-style nested workspace permissions, or GitHub-style repo/org/team access). Rather than each company reinventing a graph-based permission store, Permify centralizes it as a dedicated service with a query language and API.

78 contributors and a Go codebase under active development (latest commit dated 2026-07-01 per the data provided) signals this isn't a side project — it's a maintained product with a company behind it, not a research prototype.

Production readiness signal

5,908 GitHub stars and 78 contributors is a healthy mid-tier open-source authorization project — not as large as OPA/Cerbos ecosystems but respectable for a narrower Zanzibar-specific tool. Latest release v1.7.1 suggests a project past the 1.0 stability line, with semantic versioning discipline.

Not publicly available: CNCF maturity level (it's not currently a CNCF project, so this isn't applicable in the usual sense), founding date, and independent production case studies beyond what's in their own docs.

Caveat worth flagging: this is authorization infrastructure — a system outage or bug here means either everyone gets locked out or, worse, everyone gets let in. Before trusting it in production, demand to see their own uptime/incident history and test failure-mode behavior (does it fail open or closed?) yourself. Don't take stars as a substitute for that diligence.

Who should use this

• Teams building multi-tenant SaaS with complex, resource-level permission requirements (nested orgs, shared documents, hierarchical teams) where RBAC alone isn't expressive enough.
• Engineering orgs with the operational maturity to run and monitor another stateful service in their critical path.
• Teams that specifically want Zanzibar's relationship-graph model rather than policy-as-code (OPA-style) or simple role checks.

Who should NOT use this

• Small teams with straightforward RBAC needs — this is real infrastructure overhead (a service, a datastore, schema management) for a problem casbin or even hardcoded role checks solve in an afternoon.
• Anyone uncomfortable with AGPL-3.0. If you're building a commercial product and modifying Permify itself, AGPL's network-use clause requires you to open-source those modifications — talk to legal before embedding it.
• Teams needing policy-as-code flexibility (arbitrary business logic, non-relationship-based rules) — OPA/Rego is a better fit than forcing everything into a relationship graph.
• Anyone who can't tolerate authorization-service latency in the request path without serious caching — check their published p99 numbers before committing.

Alternatives

• OpenFGA — CNCF-hosted, also Zanzibar-inspired, Apache 2.0 licensed (no AGPL copyleft concerns), backed by Okta/Auth0.
• Open Policy Agent (OPA) — general-purpose policy engine, better for ABAC/complex business rules, not relationship-graph-native.
• Casbin — lightweight, embeddable, good for simpler RBAC/ABAC without running a separate service.

Pricing

Fully open source under AGPL-3.0 — self-host for free. Permify Inc. also offers a managed cloud version; pricing for that is not publicly available in the data provided, so check their site directly before assuming cost.