Permify is an open-source Zanzibar-style authorization engine now part of FusionAuth. See features, self-hosting pricing, and top alternatives.
Permify is an open-source authorization service built around the ideas in Google's Zanzibar paper, the system Google uses to manage access control for products like Drive, YouTube and Google Cloud. Rather than hard-coding permission checks into application logic, engineering teams model roles, relationships and attributes in a dedicated Permify schema and query a centralized service for real-time access decisions.
Founded in 2022, Permify grew into a widely adopted open-source project used by both startups and Fortune 100 companies before being acquired by identity platform FusionAuth in November 2025. The core Community Edition remains free, open source under the AGPL-3.0 license, and self-hostable via Docker or Kubernetes.
Permify's core strength is its support for role-based (RBAC), attribute-based (ABAC) and relationship-based (ReBAC) access control through a single unified policy language. This lets teams express complex permission graphs, such as nested organizations, shared folders or delegated admin rights, that traditional role tables struggle to represent.
The service exposes gRPC and REST APIs for permission checks, bulk permission listing, and access-control-list lookups, with response times designed to stay in the low milliseconds even at large scale. Multi-tenancy support lets a single Permify deployment isolate authorization data and policies per customer or business unit.
Permify's Community Edition is free and open source, and teams can self-host it indefinitely with no seat or usage fees beyond their own infrastructure costs. For teams that prefer a managed option, Permify previously offered Permify Cloud, a hosted, SLA-backed service with backups and enterprise support.
Following the November 2025 acquisition by FusionAuth, managed and enterprise pricing for Permify is now handled through FusionAuth's commercial plans, so organizations evaluating paid options should contact FusionAuth sales directly for current quotes.
Permify is an open-source authorization service, inspired by Google Zanzibar, that centralizes fine-grained permission logic such as RBAC, ABAC and ReBAC outside of application code.
Yes. The Permify Community Edition is free and open source under the AGPL-3.0 license and can be self-hosted indefinitely.
No. Permify was acquired by identity platform FusionAuth in November 2025 and now operates as Permify, a FusionAuth company.
Permify supports role-based access control (RBAC), attribute-based access control (ABAC) and relationship-based access control (ReBAC) in a single schema.
Both are Zanzibar-inspired authorization platforms, but Permify is open source and self-hosting first, while Permit.io is a commercial, hosted-first platform with a low-code policy UI and a free managed tier.
Permify is a comparable alternative to OpenFGA and Auth0 FGA, since all three are open-source, Zanzibar-inspired authorization engines with similar relationship-based modeling approaches.
No. Permify is typically integrated incrementally by replacing existing permission checks with calls to the Permify API rather than requiring a full rewrite.
The Permify Community Edition is released under the AGPL-3.0 open-source license.