Run your First Policy Check (Managed Cloud PDP)
Run your first policy check to confirm that the policy you configured works. The check goes to a policy decision point (PDP), which decides whether a user can perform an action on a resource.
This guide uses the Managed Cloud PDP hosted by Permit.io at https://cloudpdp.api.permit.io.
It is fully managed and eventually consistent. Use it to try Permit and for production workloads that don't require strict read-your-own-writes guarantees.
If you already know you need ABAC policies, strict read-your-own-writes consistency, or to keep all authorization traffic inside your own VPC, you can skip ahead to
Run Local Authorization Microservice (Edge PDP).
Before we start: Understanding the check function
The check function is the guard in your application's access control. It asks whether a user
can perform an action on a resource, and your code proceeds only if the answer is yes. It takes
the user ID, action, and resource, sends them to the PDP, and returns the decision.
What exactly are the arguments passed into the
permit.check()function?
user: a unique string id or object that identifies the user performing the action.action: the action performed.resource: the resource (object) the action is performed on. Can be a string or an object.
Place this guard wherever your application needs to enforce the policy you configured.
The check function can accept various arguments beyond the user and resource.
Understanding Your Policy Configuration
Here is the policy for this example. The Admin role can create, delete, publish, and read, but it cannot update.
Reviewing User Assignments
There are two users, and only one has the Admin role. This example checks permissions for Macy Smith, who holds the Admin role.
Setting Up the Enforcement Point
The enforcement point in your code looks like this:
This code snippet:
- Identifies the user making the request
- Specifies the action being attempted
- Names the resource being accessed
- Returns a boolean indicating whether the action is permitted
Testing Initial Permissions
Run the check with the current permissions:
The check is denied, because Macy doesn't have the update permission.
Updating Permissions
Change the permissions so the Admin role, and therefore Macy, can update the Document.
Testing Updated Permissions
Run the check again with the updated permissions:
The check is allowed. Macy can now perform every action, including update, and you didn't change any code.
For latency-sensitive deployments, we recommend deploying a local PDP to minimize network latency and ensure high availability. Learn more in our Local Authorization Microservice guide and the Cloud PDP Capabilities page.
What did you learn?
By configuring the Cloud PDP for policy checks, you've learned how to:
- Import and initialize the Permit SDK in your project
- Set up an enforcement point in your code using the check function
- Validate user permissions against your configured policies in real time
- Use the Cloud PDP for RBAC policy decisions
What's next? 🎉
- Set up a local PDP for enhanced performance
- Configure your application for local authorization
- Learn about monitoring and debugging your PDP
Amazing! You've mastered cloud policy checks.