☀️ Summer Hackathon Is Coming – And You Get to Decide What We Build! 🛠️ Hey <!everyone>! We’re kicking off our Summer Hackathon, and this time, you’re in the driver’s seat. 🚀 Got a crazy idea for permissions, access control, identity, or auditing? Whether it’s a dream feature for Permit.io or a wild new frontier in AI, data warehouses, or DBs — we want to hear it. 🎤 Submit your pitch in any format you like: – Video (preferred!) – Audio – Or even just text if you’re camera-shy 😅 Our dev team will pick their favorite ideas and build them. Yes, really. This is your chance to shape what we create next — even ideas outside the current roadmap are fair game! Drop your pitches in this Slack thread, or DM us directly. Let’s build something amazing together. 🔥 Let the hacking begin!

Congratulations ! Both docs.permit.io and OPAL.ac now have our beloved support AI agent embedded in them - for you to easily ask questions. With this we’ve also added the very much needed search-bar for the OPAL docs. 🔍 🤖 opal new check

<!channel> Have you given the Permit CLI a go yet? Check it out! now it’s live on our docs - https://docs.permit.io/how-to/permit-cli/ Covering some awesome capabilities, including: • Replaying audit logs for testing • Generate policies from free-text via AI (RBAC only for now) • Export your Permit-env as Terraform • Permit checks right from the CLI • Query the Permit API and directory from the CLI • Setup Gitops

<!channel> Building MCP servers? Using FastMCP? It’s now easier than ever to add fine-grained authorization with

permit_fastmcp

Check it out on FastMCP’s official site: https://gofastmcp.com/integrations/permit As well as the OSS repo itself - https://github.com/permitio/permit-fastmcp Install

# Using UV 
uv add permit-fastmcp

# Using pip
pip install permit-fastmcp

Add the Permit-FastMCP middleware

mcp = FastMCP("My MCP Server")

# Add <http://Permit.io|Permit.io> authorization middleware
mcp.add_middleware(PermitMcpMiddleware(
    permit_pdp_url="<http://localhost:7766>",
    permit_api_key="your-permit-api-key"
))

@mcp.tool
def my_tool(data: str) -> str:
    return f"Processed: {data}"

Easily add policies with Permit s always (Policy Editor UI, API, SDK, Terraform, Rego) .

Styra might be gone; but we’re here for you, and all the other OPA users https://www.linkedin.com/feed/update/urn:li:activity:7364405432691449857/

📌 PDP v0.9.6 released A new version of PDP is now available:

permitio/pdp-v2:0.9.6

We recommend upgrading to stay up to date. Full changelog: https://github.com/permitio/PDP/releases/tag/0.9.6

Hello everyone, Please be informed our support here and in other channels will be slightly more slow starting today and until October 15th. With our main support team on holiday. Our EST available support team will still be highly available. Contractual SLA respected and preserved regardless. Wishing you all a great autumn season 🍂 🍁 🎃 Thank you.

Hey <!everyone>! OPAL v0.9.0 is now live! opal new🚀 ⚠️ Notice: OPAL v0.9.0 ships by default with OPA v1 and include

OPAL_V0_COMPAT=true

set by default. In OPAL v0.10.0, this flag will be disabled. We recommend following the OPA Version Migration Guide for a smooth transition. ✨ New Features • ♻️ Inline OPA upgraded to v1 • ⚙️ OPA v0 compatible config enabled by default • 🐳 New EOPA OPAL Client Docker images • 🐧 Added Alpine variants for Docker builds 📖 Full changelog → https://github.com/permitio/opal/releases/tag/0.9.0

🚀 Cloud PDP Just Got an Upgrade! We’re excited to announce a new release of Cloud PDP (

<http://cloudpdp.api.permit.io|cloudpdp.api.permit.io>

/

<http://cloud-pdp.api.permit.io|cloud-pdp.api.permit.io>

) packed with powerful new features and enhanced support for higher scale! 🎉 ✅ This version is 100% backward compatible with the current Cloud PDP, so everything will continue to work seamlessly on your end. 📚 Curious about what’s new? Check out the updated docs here. permiticon As always, if you have any questions or feedback, feel free to reach out - we’re here to help!

In Permit, everything that runs on your side is open source, so you can trust and expand it. With that, we want to give a shout-out to @Nikola Tosic and the Uptick team for their recent contribution to Permit’s Terraform Provider. Nikola and the team added several much-needed capabilities that make managing authorization through Terraform far more complete. Their work introduces new resources for role assignments, resource instance management, and ReBAC role assignments for both users and groups. They also added a

permitio_user

data source and implemented import support for roles and ABAC rules, making it easier for teams to migrate existing policies into Terraform without rebuilding them from scratch. These improvements enable stronger policy-as-code workflows, better drift detection for key resources, and smoother Terraform adoption for teams managing authorization at scale. Huge thanks to Nikola and the Uptick team for contributing these enhancements and helping make the Permit ecosystem stronger.

Hey <!everyone> 👋 Big launch today. Permit MCP Gateway is live. Upvote us on Product Hunt 🎉 For those following the MCP security space, you know the gap: MCP handles basic authentication, but there’s no per-tool authorization, no human-to-agent delegation tracking, and no audit trail. Agents connect and get access to everything on the server. That’s fine for local dev. Not fine for production. Permit MCP Gateway is a proxy that sits in front of any MCP server and adds what’s missing: • Fine-grained authorization per tool, per user, per action • Human-to-agent delegation chain with trust ceilings • Consent flows for sensitive operations • Full audit log of every allow/deny decision • Auto-generated policies for every tool on the server It runs on the same policy engine you already know from Permit. OPA, Zanzibar-style ReBAC. If you’re already using Permit for your app authorization, extending it to MCP is the same model. Integration is one URL change per MCP server. No SDK. No code changes. Links: 🔗 Product page: https://permit.io/mcp-gateway 📖 Docs: https://docs.permit.io/permit-mcp-gateway/overview 🚀 Try it: https://app.agent.security 🎬 Launch video: 🗳️ Product Hunt: https://www.producthunt.com/posts/permit-io-mcp-gateway If you try it today, drop your feedback here or in #mcp-gateway. We’re shipping fast on this, and your input directly shapes what comes next.

<!here> We have an issue with the DB, you might see missing roles, we are working on fixing it ASAP.

<!here> DO NOT RESTART YOUR PDP,

As long as you don’t restart them everything will operate as usual

But you can’t edit your policy in the website.

or via the API

ETA is around an hour, we are waiting for the full db restore to prevent any data loss.

<!here> incident was resolved around 2 hours ago, we did some extensive checks to make sure everything looks good. In case you did changes in the UI/API between 12:00 UTC and 13:00 UTC, please re-run it just in-case (only around this hour).

Following the incident from yesterday, see the attached file for a detailed RCA. The full report is attached as a PDF, it covers what happened, the impact, and the corrective actions we’re taking. Let us know if you have any questions or concerns, we’re here.

[Spring Holidays 🌺 🌷 - reduced support availability] Hey everyone 👋 Quick heads up that over the upcoming Spring holidays (including Easter, Passover), parts of our team will be on reduced availability. You may notice slightly slower response times in our Slack community and general support channels. That said — for customers on paid plans, all contractual SLAs will continue to be fully met, and urgent issues will be handled as usual. We want to wish everyone celebrating a joyful and restful holiday season, however you’re spending it 🌸 Thanks as always for your patience — we’ll be back to full speed right after.

We are having some issues with the backend, we are investigating it, no changes were made recently, so it might be on the AWS side. We will update asap.

The issue was resolved, the system is up and running now.

We had some slowness in the DB due to an enormous spike of data (might be a DOS), we have placed some more protection against future occurrences and resolved the issue.

Earlier today we had around 40 minutes of service degradation in our OPAL server, due to AWS connection issues inside our VPC. Active PDPs should not have been affected (except for receiving policy updates), but please note that you can protect your production from any connectivity issues on our side with the “PDP offline mode”, an explanation can be found here: https://docs.permit.io/how-to/deploy/offline-mode/

🚀 Introducing Permit Nexus PDP 🕸️ We’ve been cooking this one for a while. Today we’re opening up Permit Nexus — our new, ground-up PDP built for authorization at massive scale and speed: trillions of authorization decisions, billions of identities, and a distributed runtime designed to keep decisions local and fast. 👉 permit.io/nexus-pdp And Nexus isn’t launching alone 👀 We’ve also shipped a major upgrade to both permit.io and our docs site. We’ve reorganized and improved the experience to make it much easier to find the products, patterns, and authorization topics you actually care about. Nexus itself isn’t just a shiny new architecture. It’s already been battle-tested in production — powering our Cloud PDP, as well as running as an edge solution with select customers. Now we want more of you to put it through its paces 😈 Want to try Nexus next? React to this message with literally any emoji of your choice and we’ll reach out. Or, even better: share your take on Nexus on LinkedIn, X, your blog, wherever you hang out — and tag Permit.io so we can join the conversation 🙌 Very excited to finally get this one into more hands. Let us know what you think! Tons of credit and love to our RND team: @Omer Zuarets , @Ze'ev Manilovich, @Eli Moshkovich and many others who contributed to this effort

image.png

<!everyone>

As a reminder, the Permit European region will be shutting down today at 00:00 UTC. We have been communicating this transition to affected customers over the past two months. This shutdown exclusively impacts organizations hosted at: app.eu.permit.io If your organization uses the standard Permit application in the US region, or if you have already completed your migration, no further action is required and you may safely disregard this message. <!everyone>

permit-python 3.0.0 is out! pypi.org/project/permit github.com/permitio/permit-python A major release of the Python SDK. It fixes dependency CVEs and SDK bugs, and adds Python 3.14 support and type information. It also comes with an AI agent skill that does the upgrade for you. Security • aiohttp 3.14.3: fixes CVE-2026-69244 and 31 other advisories • pydantic floors raised past CVE-2024-3772 • httpx removed (the SDK never used it), which also removes the h11 and anyio CVEs • Every PR and release is now gated on a dependency CVE scan, so nothing reaches PyPI without a passing scan Bug fixes • ABAC:

bulk_check()

and

filter_objects()

now pass your context through. Context-based checks used to be evaluated against an empty context • Sync client: the

permit.api.*

methods no longer raise an error after the write already went through •

authorized_users()

,

get_user_permissions()

and

filter_objects()

work on

permit.sync.Permit

•

authorized_users()

works on pydantic 2 • A wrong API key now shows the real 403 instead of “cannot connect to the PDP container” •

first_name

and

last_name

are no longer dropped from checks New • Python 3.14 support • Type information (

py.typed

): mypy and pyright now check your calls into permit • Tested on Python 3.10 to 3.14, with both pydantic 1 and pydantic 2 Breaking changes • Requires Python 3.10+ • httpx is no longer installed with permit, so add it yourself if your code uses it • A few API changes, for example

resource_relations.list()

now returns a page, and the three sync-client methods above no longer need

await

. The migration guide lists every change with before/after examples Let an agent do the upgrade The

permit-python-3-migration

skill takes an AI agent such as Claude Code through the whole migration guide: 1. Download

permit-python-3-migration.skill

from the release and unzip it into

.claude/skills/

2. Ask “upgrade permit to 3.0.0", or run

/permit-python-3-migration

It checks your Python version first, then: • scans your project • updates your dependencies and applies the mechanical edits • asks you about every judgement call • runs your tests, type checker and linter at the end Just want the list of changes? The scanner is read-only and runs on its own:

python3 .claude/skills/permit-python-3-migration/scripts/scan.py .

📚 Migration guide: github.com/permitio/permit-python/blob/…/MIGRATION.md 📝 Release notes: github.com/permitio/permit-python/…/v3.0.0 📦

pip install -U permit

permit-golang v1.3.0 is out v2 work is in progress, and it will be released soon A maintenance release of the Go SDK’s v1 line, with bug fixes and dependency cleanup. Still supports Go 1.19 and later.

go get <http://github.com/permitio/permit-golang@v1.3.0|github.com/permitio/permit-golang@v1.3.0>

Read before upgrading • Checks now use the resource instance.

Check

,

BulkCheck

,

AllTenantsCheck

and

FilterObjects

send the resource key (from

WithID

,

WithKey

or

GetID()

), so the PDP decides per instance instead of per resource type. If you use instance-level roles or relationships, decisions can change: make sure the IDs you pass match your resource instance keys in Permit. To keep a type-level check, leave the ID and key empty. • A failed check returns an error, not a deny. If the PDP answers with a status the SDK doesn’t handle, such as a rate-limited 429, the check methods now return an error. Before,

Check

returned

false

with no error. Fixes •

ConditionSets.List

returns your condition sets; it always returned an empty list. •

ResourceActionGroups.Delete

deletes the action group. Before, it deleted the resource action with the same key. If you called it, check your resources’ actions. •

AllTenantsCheck

returns only the tenants where the action is allowed. •

Tenants.List

and

Tenants.ListByAttributes

return request errors instead of an empty list. •

WaitForSync

is safe to use concurrently and no longer affects other requests. • Context errors keep the underlying cause and status, and point to

client.Api.SetContext(ctx, project, environment)

. • Several list methods return an empty list instead of nil or a panic; a short API URL or a nil logger no longer panics. Dependencies • The SDK no longer requires

<http://golang.org/x/net|golang.org/x/net>

or

<http://golang.org/x/oauth2|golang.org/x/oauth2>

, so your module stops inheriting their old minimum versions. Questions or issues? Reply here or open an issue on github.com/permitio/permit-golang/issues>.