Skip to main content

Load custom data for policy decisions

Load the attributes and other data that your policies evaluate, such as a user's department or a resource's owner. This page is for developers who build attribute-based access control (ABAC) policies and need to decide where the data comes from. It compares four ways to load data and links to the page that covers each one.

Choose how to load data​

MethodWhere the data is storedWhen to use it
DashboardPermit stores the attributes with the user or resource recordSet or test attributes by hand
Permit APIPermit stores the attributes with the user or resource recordSync attributes from your application code
permit.check() inputNot stored. You pass the attributes in each checkPass attributes that change per request, such as the current location
External data source with OPALThe PDP loads the data from your data source, and the data doesn't go to the Permit control planeUse data you keep in your own systems

Attributes from the stored record, the external data source, and the check input are combined at decision time. When the same attribute comes from more than one source, the check input takes precedence over external data, and external data takes precedence over stored attributes. See Use an external data source.

Set attributes in the dashboard​

Edit the attributes of each user on the Directory screen of the Permit dashboard. Permit stores the attributes with the user record. When you run permit.check() for the user, the policy decision point (PDP) evaluates the policy with the stored user attributes.

Before you set an attribute on a user, define the attribute in the policy. See Define attributes.

Pass attributes in permit.check()​

permit.check() takes a user, an action, and a resource. Instead of a user key and a resource type, pass objects that include attributes. The PDP evaluates the attributes in that check only, so you can pass dynamic, just-in-time attributes that you don't store in Permit.

The following check passes the location and department attributes of the user and the isPaying attribute of the file resource:

const permitted = await permit.check(
	{
		key: "john@smith.com",
		attributes: {
			location: "England",
			department: "Engineering",
		},
	},
	"read",
	{
		type: "file",
		attributes: {
			isPaying: "true",
		},
	}
);

A user and a resource can each have multiple attributes. For the full check syntax, see Check permissions with permit.check().

Large data sets

A single PDP loads all the data of its environment. For very large data sets, you can split the data between multiple PDPs with Sharded Edge PDPs.

Set attributes with the Permit API​

Every action in the Permit dashboard is also available in the Permit API, so you can automate data loading from your application or scripts.

  1. Define the attributes of a resource type or of users with the Resource Attributes API and the User Attributes API.
  2. Set attribute values when you create or update users, tenants, and resource instances. See Sync users.

Load data from an external source with OPAL​

Use the Scope Configurations API to add your own data sources to the PDPs of an environment. The Open Policy Administration Layer (OPAL) in each PDP fetches the data from your source. The data isn't sent to the Permit control plane.

By default, the PDP also loads the users, roles, tenants, and other data you store in Permit.

For the setup steps and an example, see Use an external data source.

Next steps​

Contents

Edit this page

Need help?