Top all-time · #4068
Permit.io
Company blog · permit.io/blog · on HN as imdbnurnotsecurityprogramming
Permit.io is the company blog at permit.io, writing about security and programming. Since 2021, 19 different Hacker News readers have linked it 123 times, most often “Policy as Code vs. Policy as Graph Comparison”. No feed was found, so read it on the site itself.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN commenters link Permit.io for its authorization and access-control content, including comparisons of authorization vendors and policy engines like OPA, Cedar and Zanzibar, and RBAC product material.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Authorization as a service for apps, APIs and AI agents. RBAC, ABAC and ReBAC with policy as code, a no-code editor and local PDPs. Start free.
Most-linked posts?
- Policy as Code vs. Policy as Graph Comparison3 people · 4 mentions · first linked 2023-06-07
- Intro to Opal – An Authorization Service for Fine-Grained Permissions3 people · 3 mentions · first linked 2022-04-27
- Protecting Your Users' Data from AI Training Crawlers2 people · 2 mentions · first linked 2024-08-20
- Identity Tokens Explained: Best Practices for Better Access Control2 people · 2 mentions · first linked 2025-03-31
- Best Practices for Implementing Hybrid Cloud Security2 people · 2 mentions · first linked 2024-09-16
- Prompt Filtering with OpenAI: Using GPT for GPT Access Control2 people · 2 mentions · first linked 2025-02-19
- Fine Grained Authorization (FGA)2 people · 2 mentions · first linked 2024-08-01
- Permit.io: Full Stack authorization as a service2 people · 2 mentions · first linked 2022-07-28
- Loading External Data into OPA: The Good, the Bad, and the Ugly2 people · 2 mentions · first linked 2022-04-11
- The Challenges of Generative AI in Identity and Access Management (IAM)2 people · 2 mentions · first linked 2025-01-09
What Hacker News says?
I'd say this is somewhere between Aserto.com and https://www.permit.io More fullstack than Aserto, but less than Permit. More pure API play, but less than Aserto. Compared to both Permit and Aserto, Warrant seems to lack open-source standards (e.g. Open Policy)
Comment linking /
on “Launch HN: Warrant (YC S21) – Authorization and access control as a service”Submitted Show HN: Low-Code ABAC – Permissions even a monkey can use (on top of OPA) as a story · 33 points
HN discussionHere are some other AuthZ as a service providers I've heard of: * Permit.io: https://www.permit.io/ * Oso: https://www.osohq.com/ And Otterize has an interesting model if you are in the k8s ecosystem: https://otterize.com/ I don't have first hand experience with any of these folks, though I have chatted with some of them.
Comment linking /
on “Supabase Auth: SSO, Mobile, and Server-Side Support”Submitted A Guide to Bearer Tokens: JWT vs. Opaque Tokens as a story · 19 points
HN discussionWhile Auth0 is an Authentication (AuthN) solution (verify your identities and add attributes to them) - Permit.io is Permissions or Authorization (AuthZ) solution (who can do what) - and enforces the actual policy within your app (for every request). AuthZ is a needed and complimentary component on top of AuthN You pass the JWTs from your AuthN solution to permit's permit.check() function. Read more: - https://www.p…
Comment linking /blog/what-is-authorization
on “Show HN: Permit Elements- UIs to let your customers manage their own damn RBAC”Submitted Loading External Data into OPA: The Good, the Bad, and the Ugly as a story · 18 points
HN discussionJimmy I truly think you're awesome (And so is SpiceDB), but the irony here stands out: "it presents opinion without any evidence or examples to justify the claim and concludes it as fact" You mean stuff like: 1) "SpiceDB, the most mature open source project inspired by Zanzibar" (though I'd vouch for that one) 2) " it is necessary beyond a particular scale which is well beyond the point at which policy engines typic…
Comment linking /blog/introduction-to-opal
on “Policy Engines: Open Policy Agent vs. AWS Cedar vs. Google Zanzibar”Submitted The Guide to MCP Auth: Identity, Consent, and Agent Security as a story · 15 points
HN discussionIn Zanziabr - The article refers to OSS implementations like SpiceDB or Ory. It's a follow-up to a more in depth article (1), trying to be a lighter read starting point. - 1: https://www.permit.io/blog/zanzibar-vs-opa
Comment linking /blog/zanzibar-vs-opa
on “Policy Engines: Open Policy Agent vs. AWS Cedar vs. Google Zanzibar”Submitted We Think That Product Hunt Is Still a Thing – Here's Why as a story · 11 points
HN discussionData filtering implementation has different approaches among the mentioned policy engine. For OPA, custom Rego code could return the allowed data, and the caching mechanism will ensure its consistency and reliability. For Zanzibar, since the policy derived from the data relations, data filtering is using is an internal part of the paper. I recommend the following article for more information about policy as code and…
Comment linking /blog/zanzibar-vs-opa
on “Policy Engines: Open Policy Agent vs. AWS Cedar vs. Google Zanzibar”Submitted Permit.io: Full Stack authorization as a service as a story · 6 points
HN discussiontoo quick man, it's a key feature: https://www.permit.io/rebac
Comment linking /rebac
on “Permission Systems for Enterprise That Scale”Submitted How to Properly Introduce AI Bots into Your Application as a story · 6 points
HN discussionRecent research conducted by Styra¹ (creators of OPA² and the Rego policy language) has revealed that policy as code (PaC) has become a critical component of the cloud-native development landscape. Nowadays, developers are utilizing PaC for every authorization vector, including developers, infrastructure, admissions, services, and applications. Moreover, new policy languages have emerged that are specific to vectors…
Comment linking /blog/scaling-authorization-with-cedar-and-opal
on “Opal – an open source cross-language policy administration tool”Submitted Policy-Based Access Control (PBAC) Isn't as Great as You Think as a story · 5 points
HN discussionSubmitted Show HN: FoAz – Use Frontend User Authentication for Backend API Authorization as a story · 5 points
HN discussionSubmitted Sorting Polar policies by pattern before choosing an Oso alternative as a story · 4 points
HN discussionSubmitted Permit MCP Gateway, a new trust and enforcement layer for MCP as a story · 4 points
HN discussionSubmitted The Challenges of Generative AI in Identity and Access Management (IAM) as a story · 4 points
HN discussionSubmitted The Arc Browser Vulnerability Exposes the Inefficiency of Row-Level Security as a story · 4 points
HN discussionSubmitted Honeycomb – A Case Study in Fine Grained Authorization as a story · 4 points
HN discussionSubmitted Permit Share-If Embeddable Access Sharing Components as a story · 4 points
HN discussionSubmitted Prompt Filtering with OpenAI: Using GPT for GPT Access Control as a story · 3 points
HN discussionSubmitted Show HN: Permit.io AI Access Control – Fine Grained Permissions for AI Apps as a story · 3 points
HN discussionSubmitted Why Data Filtering Matters for Database Authorization as a story · 3 points
HN discussionSubmitted Show HN: Permit.io's new predictable, startup-focused pricing model as a story · 3 points
HN discussionSubmitted Intro to Opal – An Authorization Service for Fine-Grained Permissions as a story · 3 points
HN discussionSubmitted Protecting Your Users' Data from AI Training Crawlers as a story · 3 points
HN discussionSubmitted Maricopa County Protects Its Voter Registration System with FGA as a story · 3 points
HN discussion
