https://linen.dev logo
Join Slack
Powered by
# permit-saas
  • q
    Hi team, I have received an email saying that Permit.io will shutdown its infra in EU and migrate to US-based Infra. But I couldn’t find an official announcement anywhere about this info, and now I’m questioning the validity of this email despite it coming from support@permit.io Would love to have a confirmation. Thank you.
    a
    o
    • 3
    • 15
  • x
    Copy code
    Subject: get_user_permissions() returns empty for users with multiple groups, and ignores group-derived grants when a user also has a direct role assignment

Environment:
- Project: default / Environment: dev
- PDP: Cloud PDP (<https://cloudpdp.api.permit.io>)
- SDK: permit-sdk-python 2.8.3, Python 3.10.7

Issue 1 — multiple groups on one user breaks all permission retrieval
User x-i-a_test-multi-group is a member of two groups (developer, data_user). Each group individually grants working permissions when assigned alone (verified via x-i-a_test-developer, group developer only, and x-i-a_test-data-user, group data_user). But with both groups on the same user, get_user_permissions() returns {} for every resource instance touched by either group — not just a conflict on overlapping resources.

Example:
user: x-i-a_test-multi-group (groups: developer, data_user)
resource: scope_artifactregistry:x-i-a_artifactregistry_france
expected: [repositories_delete_artifacts, repositories_download_artifacts, repositories_upload_artifacts]
actual:   []

5 of 5 checks failed for this user across all its resource instances.

Issue 2 — direct role assignment on a user causes their group-derived grant to be dropped
User x-i-a_test-data-user has both a group (data_user) and a direct role assignment (run.builder on scope: france) in the same membership entry. The direct role's permissions (france scope) resolve correctly, but the permission granted purely through the data_user group (on a different scope, project_a) comes back empty:

user: x-i-a_test-data-user
resource: scope_storage:x-i-a_storage_project_a
expected: [buckets_get, buckets_list]   <- granted via group "data_user"
actual:   []

By contrast, x-i-a_test-direct-role (role only, no group) resolves correctly, confirming the role path itself works — it's specifically the presence of a group and a role together on one user that suppresses the group's grant.

Ask: Is this expected PDP behavior (e.g. groups + roles or multi-group not being additive/merged), a caching/propagation issue, or a bug in permission resolution? Happy to share full config (group->role assignments, membership.yml) and a repro script (config/auth/validate_permit.py) that reproduces both against our environment on request.
    a
    e
    o
    • 4
    • 5
  • j
    Hi can I check if webhook notifications are still being sent when the roles are changed using the User Management Permit Element? This used to be working previously, but when I set-up a new project and enabled the webhook, this no longer seems to be the case
    a
    • 2
    • 21
  • m
    Hello, We're running the Permit.io PDP as a local sidecar (permitio/pdp-v2:0.9.9) alongside our Go service and want to confirm that authorization decision logs are being synced to the Permit.io cloud dashboard. We'd like to understand what's required to ensure this works reliably and how to verify it's active. Our setup: - Go SDK: github.com/permitio/permit-golang v1.2.8 - PDP image: permitio/pdp-v2:0.9.9, running as a Docker sidecar on port 7000 (internal) - The SDK client is initialized with WithPdpUrl(...) pointing at the sidecar, and Check() calls are routed to it - PERMIT_IO_API_KEY is being to the PDP container - The PDP has outbound internet access to api.permit.io What we're asking: 1. With this setup, does the PDP automatically push decision logs to the Permit.io cloud, or does something need to be explicitly enabled? We see api_decision_logs_ingress.go in the SDK but we are not calling it ourselves — is that expected, or should the application be calling it directly? 2. Is there a specific PDP environment variable or anything else that we need to set to activate decision log shipping? 3. How can we verify that decision logs are actually reaching the cloud — is there a dashboard view, a health endpoint on the PDP that reports sync status, or a log message we should look for in the PDP container output? 4. Are there any known issues or caveats with decision log sync on PDP version 0.9.9 specifically? Thanks.
    a
    d
    • 3
    • 5
  • w
    Hi team, I need your help to stop/cancel my subscription on my account. Can someone please attend to this request?
    a
    o
    n
    • 4
    • 10
  • v
    Hi Team, Need help with invoice for the current month.
    a
    o
    n
    • 4
    • 9
  • v
    s the horizon service experiencing issues? Seeing permit sidecars failing to start
    a
    o
    • 3
    • 7
  • h
    Hello, I would like to ask if there are any PDP environment variables that support data storage in a database or sharding; I am not sure if loading hundreds of millions of data records into OPA is feasible
    a
    d
    • 3
    • 12
  • j
    Hello. I'm provisioning new users using the Send Consistent Updates (Read-Your-Own-Writes) approach documented here: docs.permit.io/how-to/manage-data/local-facts-uploader. I haven't figured out how to assign the user to a tenant using this approach. Is there a way to do it, or is this only possible via Cloud API?
    a
    o
    • 3
    • 7
  • w
    hi, can someone help with understanding pricing? we are evaluating permit and need to build cost analysis as part of the proposal
    a
    • 2
    • 15
  • s
    @wesley.wu m’y name is Shay and I’m a human 🤓 working at Permit.io. If you’ll inform your projected number of MAU I’ll be happy to supply a price estimate and an explanation about your options
  • j
    Hi team, can someone help me with a bridge letter for SOC 2 Type II? It will help us with our upcoming audit
    a
    o
    d
    • 4
    • 11
  • h
    How can I block 
    /check
    requests on the PDP so that the permission check only proceeds once the PDP has the latest data? @Ask Inkeep
    a
    d
    • 3
    • 13
  • a
    Hi Team, Is there a plan to implement this feature? We really need it as we need to sync our tenant identity across systems that we use. permitio.canny.io/feature-requests/p/key-on-tenant
    a
    o
    +2
    • 5
    • 8
  • a
    hello guys. I am evaluating Permit.io capabilities, and I have a bunch of complex policies, involving multiple entities and attributes. I would be abale to express them as XACML or Alpha, but I am a bit unsure how to use the Control Plane to build them (also considering that Permit.io uses Rego as DSL)
    a
    o
    • 3
    • 31
  • v
    Hello, Can someone help me extend the trial period? I am testing out a few things currently and would really appreciate extending my trial period. Thanks!
    a
    o
    • 3
    • 9
  • j
    Hi Team, We'd like to better understand Permit's capabilities and how it could help us manage access management. Would it be possible to set up a demo and a short technical discussion with your team? Thanks
    a
    • 2
    • 3
  • s
    Hi @Jiten Singh unfortunately and due to limited resources we can only meet customer using our Enterprise tier license package, I recommend visiting our documentation center where you’ll find extensive knowledge
    👍 1
  • v
    Hello, can someone please help me understand this? I found that the Elements data/* endpoints are just scoped views of the same underlying data that the Facts/Schema/PDP endpoints expose. 1. api.permit.io/v2/elements/…/users returns same data as end_user → GET /v2/facts/{proj}/{env}/users 2. api.permit.io/v2/elements/…/user-invites returns same data as user_invite → GET /v2/facts/{proj}/{env}/user_invites 3. api.permit.io/v2/elements/…/audit_logs returns same data as pdp_audit_logs → GETapi.permit.io/v2/pdps/…/audit_logs 4. api.permit.io/v2/elements/…/roles returns same data as role → GET /v2/schema/{proj}/{env}/roles Can you please confirm this is true and why do we have two different endpoints fetching the same set of data? Please let me know if I am missing something here. Truly appreciate your insights here. Thanks!
    a
    d
    o
    • 4
    • 20
  • a
    Hi, is the Permit.io feedback page still active? I don't see a lot of activity there and have a few bugs to file. We are on the Pro plan if that's important.
    a
    o
    • 3
    • 6
  • l
    Hello, guys! Here at AllieHealth we've been going through a weird quirk we believe some version of the API seems to have introduced at some point: identically-named roles being assigned to the wrong resource type. Take this check, for example:
    Copy code
    curl -sS -H "Authorization: Bearer $env:PERMIT_PROD_KEY" "<https://api.permit.io/v2/facts/default/production/role_assignments/detailed?user=12354&tenant=default&per_page=100>"
    It returns something like:
    Copy code
    {
  "id": "004242fee3b54d94a5f1caadd52b2ff4",
  "role": {
    "id": "865927aa193e40ebbb2a1bfec64de774",
    "key": "SchedulingExecutive",
    "name": "SchedulingExecutive",
    "permissions": [
      "Company:read-company",
      ...
    ]
  },
  "user": {
    "id": "0b7823e7c956452285e90375d7550e02",
    "key": "12354",
    "email": null,
    "first_name": ...,
    "last_name": ...,
    "attributes": null
  },
  "tenant": {
    "id": "463ab023370c43b6b383d2cced12afb4",
    "key": "default",
    "name": "Default Tenant",
    "attributes": null
  },
  "resource_instance": {
    "id": "00904ff7cbdc402aaf372e9ef1c444de",
    "key": "194",
    "resource": "Community",
    "attributes": { ... }
  },
  "organization_id": "75ba10ce33df4af49b3d3f28251ad325",
  "project_id": "06a201217bf34db08ced08463a3c1e68",
  "environment_id": "c2806df4431a49d49390e0d61fe1ee3e",
  "created_at": "2026-01-23T15:45:51+00:00"
}
    Notice how the permissions given start with 
    Company:
    , which all come from 
    Company#SchedulingExecutive
    , but have been applied to 
    Community#194
    as if they were 
    Community#SchedulingExecutive
    because with the Node.js SDK we used to refer to it simply as 
    SchedulingExecutive
    and expected the API to pick-up the correct resource type on Permit's side. Now, the problem is we're trying to fix these mismatches, both through the web UI panel or through the SDK/API; neither works (generally just a 404 or generic error message). Is this a known regression? If so, has it been patched at some point? And how to recover from it for existing users without having to recreate all? Thanks!
    a
    o
    +3
    • 6
    • 20
  • j
    Hi team, we are using the Python SDK and noticed that there are some high and critical vulnerabilities on the dependencies such as 
    anyio
    and 
    aiohttp
    . Is there a plan to fix this? Our internal security compliance policy strictly prohibits us from deploying applications that contain third-party dependencies with unresolved vulnerabilities. Thank you.
    a
    o
    z
    • 4
    • 11
  • s
    This message was deleted.
    a
    b
    • 3
    • 14
  • s
  • i
    sriranjini.ks@rubrik.com/ Hi team, Could you please lookinto this profile, Guest is trying to add the card in his profile to book the hotel and unable to add the card and it keeps telling invalid card and unable to add.
    a
    o
    d
    • 4
    • 5
  • i
    Hello folks. we are looking to cancel our subscription and can't find any billing information listed. I reached out to one of your colleagues but looks like they're not with you anymore. I'm told to raise a cancellation notice in the support channel. Can someone point me at the channel pls (is it in slack or an email).
    a
    o
    • 3
    • 7
  • w
    hi all. the PDP which is running in ECS behind an ALB typically responds very quickly. but we are seeing that there are intermittent spikes in latency and traced them to 5xx errors on the PDP with these corresponding logs:
    Copy code
    Failed to send request to OPA: Failed to send request to OPA: error sending request for url (<http://localhost:8181/v1/data/permit/root>)
    also see a couple of these at the same time we see the above
    Copy code
    Health check failed: opa: Failed to connect to OPA … <http://localhost:8181/health>
    these tasks are well provisioned, not seeing it anywhere close to being starved for resources. any idea what the cause might be? we see the spikes (which correlate to spikes in traffic from about 5 req/s to about 100 req/s) and then the latency returns to baseline after the burst in load passes. are there limits to what OPA can handle or best practice for how to handle these bursts? i found this similar thread above but not sure if there was any resolution
    a
    e
    • 3
    • 9
  • d
    Hi Everyone 👋 It’s David from Permit. Just a heads-up that we’ll be performing routine maintenance on our system on Monday, November 9 at 5:00 PM EST (22:00 UTC). We don’t expect any downtime and there’s nothing you need to do. As with any maintenance, there’s a small chance of brief service disruption. We’re sharing this in advance in case you notice anything unusual at this time. Thank you 🙂
    a
    • 2
    • 3
  • s
    Hi, we’re getting some 500's from the API. Is there anything going on with the service?
    a
    o
    z
    • 4
    • 10
  • d
    Hi Everyone, Please note there is an ongoing incident. Starting at about 08:30 UTC, changes to policies did not reach PDPs. From 09:35 UTC, PDPs that started or restarted could not load their policies. The issue is caused by a changes in Github to the encryption methods it accepts for SSH connections. The service that syncs policies from Git used a method that was turned off. If your PDP is enabled in offline mode or you have GitOps, it’s still working. We have applied a fix and policy syncing is recovering now. We will post an update when all PDPs receive policy updates normally.
    a
    • 2
    • 3