Permify

Limitations

• PostgreSQL engine coupling: Permify relies on PostgreSQL internal types (xid8 and pg_snapshot) for snapshot isolation, preventing deployment on MySQL or distributed PostgreSQL-compatible engines like CockroachDB without schema modifications.
• Public schema dependency: database migrations require installation directly in PostgreSQL's public schema, creating friction for enterprise environments that mandate dedicated schemas for database separation.
• Lack of embedded in-process execution: Permify runs exclusively as an external daemon over gRPC or REST, requiring a network hop for every check rather than running as an embedded in-memory library.
• Absence of relationship wildcards: the schema engine cannot express global administrative bypasses or blanket wildcards across entity types, requiring explicit permission tuples for every resource hierarchy.

Who should use it

• Microservice platform engineers who need to centralize access logic across multiple languages without building custom permission middleware for each backend service.
• B2B SaaS developers who need fine-grained, hierarchical resource sharing—such as document-level folder permissions—that exceeds the capabilities of standard role-based access control.
• DevOps teams operating in regulated environments who need to run authorization inside their own private VPC or Kubernetes cluster to satisfy strict data-residency requirements.

FAQ

Does Permify replace Auth0? No. Auth0 handles user authentication and identity tokens, whereas Permify handles runtime authorization checks; teams typically use Auth0 to verify identity and Permify to evaluate permissions.

Can Permify run without an external database? Permify includes an in-memory storage engine suitable for local testing, but production deployments require a persistent PostgreSQL database to store relationship tuples.

How does Permify achieve low latency on deep permission checks? Permify evaluates relationships as a directed graph using concurrent traversal algorithms and in-memory caching, returning permission decisions in tens of milliseconds even across nested resource trees.

Verdict

Permify is the right fit for teams designing complex, hierarchical permissions who want to avoid vendor lock-in and keep authorization checks close to their backend services; it is unnecessary overhead for simple web applications that only need basic role badges on user profiles. With active maintenance following its acquisition by FusionAuth—continuing regular updates through September 2026—the project operates under the AGPL-3.0 license, which warrants architectural review if you intend to distribute hosted authorization services to third parties.