Skip to main content

Permit Nexus PDP

Product overview: Nexus PDP

Permit Nexus PDP is a self-hosted policy decision point (PDP) that keeps your environment's policy and authorization data in an embedded on-disk database. This page is for architects and platform engineers who decide whether to run Nexus PDP instead of, or next to, the container PDP.

Nexus PDP ships as the permitio/pdp-v3 container image. You run one Nexus PDP container per Permit environment in your own network. Nexus PDP answers each authorization query from its local copy of the data, so no hop in the decision path leaves the container.

Early access and relationship to the container PDP

Nexus PDP is an additional deployment option. It does not replace the container PDP (permitio/pdp-v2), which remains supported and is the PDP to use for the capabilities listed as unsupported in Nexus PDP feature parity.

As of September 2026, Nexus PDP is in early access and Permit enables it per account. To request access, book a call with Permit.

Terms used on this page​

TermMeaning
Container PDPThe Edge PDP image permitio/pdp-v2. It runs an API server, the Open Policy Administration Layer (OPAL) client, and Open Policy Agent (OPA) in one container. See Run an Edge PDP with Docker.
Control planeThe Permit cloud service that stores your policies and data and sends updates to your PDPs.
Change streamThe ordered, durable stream of data changes that the control plane sends to each Nexus PDP.

Limits of the container PDP that Nexus PDP removes​

The container PDP stores your authorization data inside OPA as a single in-memory JSON document. That storage model limits the container PDP in three ways.

Relationship queries run against a JSON document​

A JSON document has no indexes and no edges between records. The container PDP cannot optimize graph traversal for relationship-based access control (ReBAC) and derived roles. Those policies ask whether a user reaches a resource through a chain of roles and relationships.

Nexus PDP stores relationship data in an embedded database built for graph traversal. OPA queries that database over the container's loopback interface while OPA evaluates the policy.

Container PDP memory grows with your data set​

The container PDP holds all authorization data in memory, so a large environment needs a large container PDP. The OPA policy performance documentation states that raw JSON loaded into OPA uses about 20 times the memory of the same data in a compact serialized form.

Nexus PDP stores the compact form on disk and keeps a cache of configurable size in memory. You set the memory budget instead of deriving it from the size of your data.

Container PDP updates need a second request​

The container PDP receives a notification that data changed, then fetches the changed data from the Permit API. After a disconnection, the container PDP fetches the data again, because the control plane does not track which updates each container PDP has applied.

Nexus PDP receives each update with the changed data inside the message. The control plane keeps each Nexus PDP's unacknowledged changes until that Nexus PDP confirms that it applied them.

What Nexus PDP provides​

  • Decisions inside the container. Every hop in a decision runs over loopback or reads local disk. No authorization query depends on reaching Permit.
  • Memory you configure. The data set lives on disk, and a configurable cache limits resident memory.
  • Sync that resumes after a disconnection. The control plane keeps changes for each Nexus PDP until that PDP acknowledges them, so a reconnecting Nexus PDP does not fetch its data set again.
  • Decisions during control-plane outages. When the control plane is unreachable, Nexus PDP keeps answering from its local copy and reports how stale that copy is on its health endpoint.

To see the processes inside the container, read Nexus PDP architecture. To see how Nexus PDP keeps its local copy current, read How Nexus PDP syncs data.

Choose between the container PDP and Nexus PDP​

Choose the container PDP when you needChoose Nexus PDP when you need
Attribute-based access control (ABAC): condition sets, user sets, or resource setsLarge data sets without a matching memory footprint
Policy as code or custom Rego bundlesRelationship queries served from a graph-capable store
Read-your-own-writes with local factsDecisions that never depend on reaching the Permit API
URL-based enforcement or the Kong integrationSync that resumes after long disconnections without fetching data again
Custom data sourcesA PDP without the Python runtime and the OPAL client
A Prometheus /metrics endpoint, or a deployment without persistent storageObservability through structured logs and detailed health endpoints

Both PDP types connect to the same Permit environment and enforce the role-based access control (RBAC) and ReBAC policies you author in Permit. You can run both side by side while you evaluate Nexus PDP.

The set of capabilities Nexus PDP supports changes between releases. Check Nexus PDP feature parity for the current list.

Contents

Edit this page

Need help?