While Permit.io is designed for authorization (controlling what users can do after they're authenticated) , not authentication (verifying user identity through OTP) , you could potentially use ABAC or custom Rego policies for certain validation logic. With *ABAC (Attribute-Based Access Control) *, you can create policies based on user attributes and conditions (1) . For example, you could check attributes like verification status or time-based conditions (2) . For more complex custom logic, you can extend Permit.io's ABAC capabilities by writing ​*custom Rego code*​ (3) . This allows you to create dynamic attributes and custom validation rules (2) . Here's how custom Rego works with Permit.io:

package permit.custom
import <http://future.keywords.in|future.keywords.in>

default custom_user_attributes["has_intersection"] = false

custom_user_attributes["has_intersection"] := true {
  user_attr_set = {x | some x in data.users[input.user.key].attributes["attr_in_user"]}
  res_attr_set = {x | some x in input.resource.attributes["attr_in_resource"]}
  count(user_attr_set & res_attr_set) > 0
}

The custom code must use

package permit.custom

and the rule name must be

custom_user_attributes

. You can add this to your GitOps repository in the

custom/

directory (3) . However, for actual OTP verification and authentication flows, you'd typically want a dedicated authentication service rather than an authorization platform like Permit.io.

To learn more, see the sources I considered: [[1] How to Implement Attribute-Based Access Control (ABAC) Authorization?](https://www.permit.io/blog/how-to-implement-abac) [[2] ABAC Design Patterns](https://docs.permit.io/how-to/build-policies/abac/patterns) [[3] Write Custom Policies](https://docs.permit.io/integrations/gitops/custom_policy)