Glossary
Here you'll find a quick reference for all the Permit and otherwise permission, authorization, and IAM buzzwords.
Permit Terms
MAU
- Monthly Active Users - the identities (end-users) you check permissions for on a monthly basis.
- Read more about user management here
Tenant
- Tenant a silo of resources and users; which in policy terms means only users within a tenant can act on the resources within the tenant
- Often a tenant would represent an end-customer of yours, but sometimes you'd want multiple tenants to represent a single logical customer tenant (for example if you have multiple departments within each logical tenant).
- Read more about tenants here
General Terms
Models
RBAC
- Role Based Access Control - A permissions model in which all permissions for an identity are derived from a role (e.g.
Admin
,Viewer
) that is assigned to it
- Role Based Access Control - A permissions model in which all permissions for an identity are derived from a role (e.g.
ABAC
- Attribute Based Access Control - A permissions model in which permissions are deduced from conditions on a sets of attributes. ABAC is the most comprehensive model - most other model can be described as subsets of ABAC.
ReBAC
- Relationship Based Access Control - A Permissions model in which permissions are deduced from the relationships between identities and various nested groups and resources (e.g. ). ReBAC is most common for nested hierarchies (e.g. org charts, file directories)
Topology
PDP
- Policy Decision Point - a network node in responsible for answering authorization queries (using a policy and contextual data)
- In Permit.io a PDP is provided as a container - meant to act as your microservice for authorization - often deployed as a sidecar to your own services.
- AKA : Authorizer, Permitter, Microservice for authorization, sidecar
- Full article
PEP
- Policy Enforcement Point - a point which enforces access to resources, usually queries a PDP for the decisions to enforce.
- In Permit.io - PEPs can be created across the stack in code vai the SDK( single line, function, route, middleware), or outside your code via plugins (Reverse Proxy, API Gateway)