Permit.io

The product is a fine-grained authorization and agentic identity control plane that governs what AI agents, services and users can do at action time across gateways, APIs and data. It addresses risks from ephemeral agents, prompt injection, standing permissions and fragmented audit in legacy IAM. It is for developers, engineering and IT/security teams in B2B companies including enterprise, fintech, healthcare and government. It is delivered as a SaaS and infrastructure API with distributed in-VPC policy decision points, built on OPA and OPAL, available managed or self-hosted.

Key features

• MCP gateway for agent interrogation
• Gateway authentication and token gating
• Human consent and delegation framework
• Agent fingerprint bound to intent
• Runtime policy evaluation with context
• Fine-grained API and service enforcement
• Data-level row and column protection
• RBAC, ABAC and ReBAC support
• Policy engine with low-latency PDPs
• Audit logs for every decision
• Just-in-time policy-backed access
• Guardian agents for anomaly detection