Hi Permit team :sunglasses: How does Permit PDP en...
# general
b
Hi Permit team 😎 How does Permit PDP ensure strong consistency between policy decisions and the underlying data, especially in scenarios where updates or events may be delayed or temporarily disconnected? Are there mechanisms similar to Zanzibar’s zookie tokens or snapshot reads to guarantee that access checks never apply outdated policies? Thank you
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
a
Hey @B22DCCN393 Nguyễn Việt Huy, thanks for reaching out! @Ask Inkeep please expand here
a
Thanks for tagging me @Alon Boshi. I'll look through relevant sources and get back to you shortly.
* Permit.io provides several mechanisms to ensure consistency between policy decisions and underlying data: *Strong Consistency via "Send Consistent Updates" (Read-Your-Own-Writes) * Permit offers a feature called ​*Local Facts*​ that routes data changes through the PDP and waits for them to be applied before responding. (1) This ensures that when you create or update data (e.g., a user or role assignment) , subsequent permission checks immediately reflect that change. (2) For example, with
proxy_facts_via_pdp
enabled, the API call waits until the data is fully synced to the PDP before returning. (1) ​*Configuration Options:*​ • `timeout`: Controls how long to wait for data synchronization (0 = no waiting, positive value = wait up to N seconds, negative = wait indefinitely) • `timeout_policy`: Defines behavior on timeout—either
ignore
(respond immediately) or
fail
(return 424 status code) ​*Consistency Guarantees Available:*​ Permit provides fine-tuned consistency options: (3) • ​*Eventual consistency*​ (PDP updates within ~100ms on P95) • ​*Fully consistent updates*​ for mission-critical policies • ​*Health-check-based consistency with callbacks*​ for dynamic environments ​*Regarding Zanzibar-style Tokens:*​ While Permit doesn't use zookie tokens specifically, the Permit Cloud itself is described as a "Google Zanzibar equivalent" (4) , and the Local Facts / Send Consistent Updates feature provides similar guarantees by ensuring the PDP has the latest data before returning from write operations. (2) ​*Offline Mode:*​ For disconnected scenarios, Permit's PDP supports ​*Offline Mode*​, allowing it to operate without a live connection to the cloud—retrieving configuration once and continuing autonomously, even after restarts.
To learn more, see the sources I considered: [[1] Send Consistent Updates (Read-Your-Own-Writes)](https://docs.permit.io/how-to/manage-data/local-facts-uploader) [[2] Permit.io Launch Week - Day 5: Fine-Tuned Performance](https://www.permit.io/blog/launch-week-5-performance) [[3] Permit Strength Points](https://docs.permit.io/concepts/differentiator-checklist) [[4] Integration with Google Zanzibar inspired Authorization Frameworks like OpenFGA, SpiceDB, Ory Keto](https://github.com/permitio/opal/discussions/633)