Permit.io Blog
permit.io · Company blog · on HN since 2021
Permit.io's company blog on authorization as a service, covering Google Zanzibar, OPA, Opal, and access control for AI.
What HN saysHN commenters cite it for comparisons of Zanzibar-style and OPA authorization, and as a lighter starting point linked to a deeper article.
19HN people shared it
4linked it in comments
114stories submitted
296story points
5 months agolast shared
2021people per year2026
Most-shared posts
- 1Permit.io: Full Stack authorization as a service4 people · 7 points · first shared 2022 · 2 comments on HN
- 2Intro to Opal – An Authorization Service for Fine-Grained Permissions3 people · 4 points · first shared 2022 · discussion on HN
- 3Google Zanzibar vs. OPA – Graph vs. Code Based Authorization3 people · 2 points · first shared 2023 · discussion on HN
- 4Loading External Data into OPA: The Good, the Bad, and the Ugly2 people · 19 points · first shared 2022 · 1 comments on HN
- 5The State of Google Zanzibar in 20242 people · 6 points · first shared 2024 · discussion on HN
- 6The Arc Browser Vulnerability Exposes the Inefficiency of Row-Level Security2 people · 6 points · first shared 2024 · 1 comments on HN
- 7The Challenges of Generative AI in Identity and Access Management (IAM)2 people · 5 points · first shared 2025 · discussion on HN
- 8Prompt Filtering with OpenAI: Using GPT for GPT Access Control2 people · 4 points · first shared 2025 · discussion on HN
- 9Protecting Your Users' Data from AI Training Crawlers2 people · 4 points · first shared 2024 · discussion on HN
- 10Best Practices for Implementing Hybrid Cloud Security2 people · 4 points · first shared 2024 · discussion on HN
- 11We Asked 200 Developers About the Future of Access Control2 people · 4 points · first shared 2025 · discussion on HN
- 12The Unspoken Tradoffs of Fine-Grained Authorization2 people · 4 points · first shared 2024 · discussion on HN
- 13Fine Grained Authorization (FGA)2 people · 3 points · first shared 2024 · discussion on HN
- 14Identity Tokens Explained: Best Practices for Better Access Control2 people · 3 points · first shared 2025 · discussion on HN
- 15The "Who" – Understanding AI Identity in IAM2 people · 3 points · first shared 2024 · discussion on HN
What HN people wrote when they linked it
orweis · 2023-08-17
In Zanziabr - The article refers to OSS implementations like SpiceDB or Ory.
It's a follow-up to a more in depth article (1), trying to be a lighter read starting point.
- 1: https://www.permit.io/blog/zanzibar-vs-opa
gemanor · 2023-08-17
Data filtering implementation has different approaches among the mentioned policy engine. For OPA, custom Rego code could return the allowed data, and the caching mechanism will ensure its consistency and reliability. For Zanzibar, since the policy derived from the data relations, data filtering is using is an internal part of the paper.
I recommend the following article for more information about policy as code and policy as data to understand the context better - https://www.permit.io/blog/zanzibar-vs-opa
mooreds · 2023-04-13
Here are some other AuthZ as a service providers I've heard of:
* Permit.io: https://www.permit.io/
* Oso: https://www.osohq.com/
And Otterize has an interesting model if you are in the k8s ecosystem: https://otterize.com/
I don't have first hand experience with any of these folks, though I have chatted with some of them.
bitweis · 2025-12-25
too quick man, it's a key feature:
https://www.permit.io/rebac