SaaS workspaces and teams
Model workspaces as /workspaces/{id}. Add people to groups such as group:acme-admins and grant the group a role on the workspace, so joining or leaving a team is one membership change.
How groups workFree to start • No credit card required
Who can do what, on every resource, in one API call
Permio is the permissions layer for teams shipping fast, including with AI coding tools. Move as quickly as you like on everything else; access control is the one part worth getting exactly right.
How it works
Resources are paths. Grant a role once and it flows down the tree. Your app signs people in; Permio tells it what each of them is allowed to do.
Resources
/projects/projects/123grant: editor → user_42/projects/123/docs/7inherited/projects/123/docs/9inherited/projects/123/invoices/2inherited
/projects/999no access/projects/999/docs/1no access
Checks for user_42 · document.edit
/projects/123/docs/9 Allowed via editor on /projects/123
/projects/999/docs/1 Denied no grant on /projects/999
Anything without a matching grant is denied. Checks fail closed.
-
Define permissions and roles
Name the actions your code checks, such as document.read, and bundle them into roles like editor.
-
Grant on a resource
Give a user, service or group a role on /projects/123. Everything below it is covered, including things created later.
-
Check from your backend
One call returns allowed or denied, with the missing permissions when it’s a no.
Check from your backend
Install the SDK and make one call per request.
TypeScript · permio SDK on npm
// npm install permio
import { Permio } from 'permio';
const permio = new Permio({ apiKey: process.env.PERMIO_API_KEY!, project: 'default' });
const allowed = await permio.check({
principal: user.id,
resource: `/documents/${docId}`,
permission: 'document.read',
});
if (!allowed) return new Response('Forbidden', { status: 403 });TypeScript uses the permio SDK and Rust the generated client
on GitHub. Every other language calls the REST API directly, which works today; Go and Python
clients are coming. Read the quickstart
Everything you need for access control
The pieces teams usually build by hand, already built and tested.
Resource-level permissions with inheritance
Grant on any resource path. A grant on /projects/123 covers every document below it.
Groups
Grant to group:editors once and every member holds it. Add or remove people without touching grants.
List filtering and share dialogs
Show each user only what they can see: listAccess gives you a database filter, and whoHasAccess powers “shared with” lists.
Access tester
See exactly why access was allowed or denied, with the grants and inheritance that decided it.
Audit log
An activity feed of every change to permissions, roles, grants, groups and API keys.
Scoped, revocable API keys
Check-only keys by default, full access when you need it. Shown once, stored hashed, revoked instantly.
Bring your own auth
Keep Auth0, Clerk, Firebase, Supabase or your own login. Your login says who someone is; Permio says what they’re allowed to do.
TypeScript SDK, REST and gRPC
npm install permio, or call the JSON REST or gRPC API from any language. Batch up to 100 resources per call.
Use cases
One model covers the patterns most apps need.
Document and file sharing
Share a folder and its files follow through inheritance. Share one file with a single grant. whoHasAccess lists everyone who can open it, for the “shared with” panel.
Access queriesMulti-tenant B2B
Put the tenant at the top of every URI, so a grant under /tenants/acme can never reach /tenants/globex. Use separate projects for dev and prod.
Multi-tenant patternAI agents acting for users
Give each agent its own principal with only the grants its user allows, and a check-only key for its backend. The agent can never do more than the user permits.
Permissions for AI agentsAdd Permio with your AI assistant
Building with Cursor, Claude Code or another coding assistant? Paste this prompt. It points the assistant at our machine-readable docs, keeps your existing login, and asks it to guard routes and filter lists properly.
Assistants can also read /llms.txt and /llms-full.txt directly.
Prompt
Add authorisation to this app with Permio (perms.io), using the `permio` npm package.
Read these first:
- https://perms.io/llms-full.txt (model, APIs and SDK usage)
- https://docs.perms.io/sdk/typescript/
Then:
1. npm install permio, and create one server-side client: new Permio({ apiKey: process.env.PERMIO_API_KEY, project: "default" }). Never ship the key to the browser.
2. Keep our existing login. Use the authenticated user's ID as the Permio principal.
3. Design resource URIs from our data model, e.g. /workspaces/{id}/docs/{id}, built with the SDK's resource() helper. Propose permission names (e.g. doc.read, doc.write) and roles.
4. Guard every route or server action that reads or changes data with permio.check() or permio.assert(), and return 403 when denied.
5. Filter list endpoints with permio.listAccess() + toPrefixes() instead of loading everything.
6. List the permissions, roles and grants I need to create in the Permio dashboard. Frequently asked questions
Does Permio handle login?
No. Permio does authorisation, not authentication. Keep your existing login (Auth0, Clerk, Firebase, Supabase or your own) and pass the user ID you already have to Permio as the principal.
How do I filter a list to what a user can see?
Call listAccess with the principal, a permission and the part of the tree you are listing (for example "/docs"). It returns scopes; toPrefixes() turns them into URI prefixes you can use in a SQL, Prisma or MongoDB filter, so you query once instead of checking row by row. For a short list you already have, batchCheck answers up to 100 resources in one call.
How does inheritance work?
Resources are paths such as /projects/123/docs/9. A grant on /projects/123 applies to that resource and everything below it, including things created later. Grants never flow upwards or sideways, so /projects/999 is untouched. A _ segment in a stored grant matches exactly one segment, for example /docs/_/comments.
What are groups?
A group is a named set of principals in a project, such as editors. Grant permissions or roles to its principal ID, group:editors, and every member holds them. Checks include a principal’s groups automatically.
Which languages are supported?
The TypeScript SDK (npm install permio) runs on Node 18+, edge runtimes and browsers. Any language can call the REST (JSON) or gRPC / gRPC-web API directly. A generated Rust client is public on GitHub, and Go and Python clients are coming.
Is there a free plan?
You can start free with no credit card required. Pricing for paid plans is coming soon.
Where is data stored?
Permio’s services run on Google Cloud Run in the London region (europe-west2), and data is stored in MongoDB Atlas. Dashboard sign-in uses Firebase Authentication and payments use Stripe.
How is Permio different from building it myself?
Hand-rolled checks tend to spread through the codebase as if-statements on roles. Permio gives you one model (permissions, roles, groups and grants on resource paths), one check call from every service, list filtering and “who has access” queries, an Access tester that explains each decision, and an audit log of changes, without building or maintaining any of it.
Start with the docs
The quickstart takes you from sign-up to your first check.
Stop hand-rolling permissions
Define it once, check it from anywhere. Free to start, no credit card required.