Control & Data planes
Learn how Permit.io splits authorization into a control plane and a data plane, and which data each plane holds. Read this page before you choose where to run your policy decision points (PDPs).
Hybrid deployment
Run beside your services and answer checks locally, without a round trip to the control plane.
- Your apps and APIs
- Your data
The two planes
| Plane | What it does | Where it runs | What it holds |
|---|---|---|---|
| Control plane | You manage policy, roles, resources, and tenants. | Permit's cloud | Your policy and the identifiers it refers to: user keys, role keys, resource keys, tenant keys |
| Data plane | PDPs evaluate every permission check locally. | Your network, next to your services | Policy and data pushed from the control plane, plus any data your policies read from sources inside your network |
Because checks run on PDPs in your network, you can use the managed features of the control plane without sending sensitive user data to Permit's cloud.
Hybrid deployment: decoupling the data plane
Hybrid is the default Permit deployment. The control plane stays in Permit's cloud, and the data plane stays in your network.
The Open Policy Administration Layer (OPAL) connects the two planes. OPAL is an open-source project maintained by Permit:
- You change policy or data in the Permit control plane.
- The OPAL server in the control plane pushes the update to the OPAL client inside each PDP.
- The PDP's policy engine answers permission checks from that local copy of policy and data.
The control plane can work with identifiers only, such as unique user IDs, without any other details about the entities behind them. Storing user details such as names and emails in Permit is optional. Keep those details in your own systems if privacy or data-residency rules require it.
Local PDP: the policy decision point
A policy decision point (PDP) is a network service that answers authorization queries using policies and contextual data. Your application sends a permission check to the PDP, and the PDP returns an allow or deny decision.
The PDP is the data plane of the hybrid architecture. You deploy it beside your own services in one of these layouts:
- As a sidecar next to each service.
- As a cluster of PDPs behind a load balancer.
- As a single instance for light workloads.
The self-hosted PDP (an Edge PDP) is a container image that bundles Open Policy Agent (OPA) as its policy engine, the OPAL client, and an API server. The image is permitio/pdp-v2 on Docker Hub. Permit also runs a managed Cloud PDP for teams that don't want to operate containers.
Next steps
- Run and connect a PDP: the PDP types, deployment models, and how to point an SDK at a PDP.
- Compare the Cloud PDP with a container PDP: supported policy models, APIs, and rate limits.
- Choose a deployment option: when the hybrid model fits and when you need an on-premise deployment.
- Configure the PDP: environment variables for a container PDP.