HTML returned; not a verified text file
https://www.permit.io/llms-full.txt ↗- Discovery
- Conventional sibling path checked
- HTTP response
- 200 · text/html; charset=utf-8
Security · llms.txt file breakdown
Permit.io llms.txt
A directly retrieved Markdown index for Permit.io, organized into What Permit.io is, Who it is for, Core problem, Architecture (hybrid).
The actual file
Source Markdown
The saved llms.txt text, displayed as source. The file belongs to its publisher; the live endpoint may change.
Complete saved Markdown shown below.
# Permit.io
> Runtime Access Control for the AI Era. Fine-grained authorization as a service: RBAC, ABAC, and ReBAC for applications, APIs, and AI agents.
Permit.io is the authorization infrastructure platform for developers and builders. Teams use it to stop rebuilding permissions in application code and instead ship a policy plane: a no-code editor, policy as code (OPA Rego or AWS Cedar), GitOps, and a local Policy Decision Point (PDP) updated by OPAL.
AI agents are first-class subjects in the same model. They are not a separate security product. An agent calling a tool is still a subject, an action, and a resource — evaluated with RBAC, ABAC, and ReBAC at decision time.
## What Permit.io is
Permit.io provides:
- Fine-grained authorization (FGA) for applications and APIs
- Role-based access control (RBAC)
- Attribute-based access control (ABAC)
- Relationship-based access control (ReBAC)
- Policy as code and a no-code policy UI
- Hybrid enforcement: decisions in your VPC via PDP
- Audit logs and decision traces
- Embedded authorization Elements (user management, approvals, audit)
- MCP Gateway and coding-agents gateway that reuse the same policy graph
Permit.io is not an identity provider. Keep your IdP for authentication. Permit.io is the authorization layer.
## Who it is for
Developers, platform engineers, and architects who need to bake permissions into products. Security and IAM teams use the same plane for least privilege, human-to-agent delegation, and audit. Product and operations teams use the policy editor and Elements so access changes do not require a deploy.
## Core problem
Most products start with a roles table and if/else checks. Then they need tenant isolation, attributes, relationship graphs, and agents acting on behalf of users. Fine-grained authorization is infrastructure — not a feature you rewrite every quarter.
## Architecture (hybrid)
- Control plane: policy UI, Git, APIs, and audit
- Data plane: PDP next to the workload (OPA or Cedar), synced by OPAL
- Decisions stay in your network; sensitive data does not need to leave the VPC
- SDKs, Terraform, CLI, and a simple check API
## Agents as first-class citizens
MCP Gateway sits in front of Model Context Protocol servers and enforces the same RBAC, ABAC, and ReBAC policies used by application PDPs. Agents receive delegated, scoped permissions from a human identity. Intent can be checked at the gateway so prompt injection that changes the job does not inherit standing access.
This is still fine-grained authorization applied at the gateway — not a second permission system.
## Products
- [App and API Permissions](https://www.permit.io/app-and-api-permissions): FGA for software
- [RBAC](https://www.permit.io/rbac), [ABAC](https://www.permit.io/abac), [ReBAC](https://www.permit.io/rebac)
- [MCP Gateway](https://www.permit.io/mcp-gateway): authorization for MCP tool calls
- [Coding Agents Gateway](https://www.permit.io/coding-agents-gateway)
- [AI Access Control](https://www.permit.io/ai-access-control)
- [Elements](https://www.permit.io/elements): embeddable permission UIs
- [CLI](https://www.permit.io/cli)
- [Docs](https://docs.permit.io)
- [Open Source](https://www.permit.io/open-source): including OPAL
## Compliance
SOC 2 Type II. Used in healthcare, fintech, government, and enterprise SaaS. HIPAA / GDPR / CCPA support as documented on the [trust center](https://www.permit.io/trust).
## Optional
- [Pricing](https://www.permit.io/pricing)
- [Customers](https://www.permit.io/customers)
- [Blog](https://www.permit.io/blog)
Measured from the saved file
Linked document
- UTF-8 text size
- 3.5 KB3582 bytes
- Token count
- 831o200k_base encoding
- Markdown links
- 1515 distinct URLs
- Fenced code blocks
- 066 lines in the file
Size measures the captured UTF-8 text, not compressed transfer size. Tokens are counted with a named tokenizer; other models can count differently. Neither measure establishes context compatibility or answer quality.
- Project H1
- Permit.io
Opening blockquote
Runtime Access Control for the AI Era. Fine-grained authorization as a service: RBAC, ABAC, and ReBAC for applications, APIs, and AI agents.
Context architecture
How the content is divided
8 H2 sections organize 15 parsed Markdown links. 0 links point to .md or .markdown paths; 1 link occurrences use another hostname. Linked destinations have not been recursively validated.
| H2 section | Links | UTF-8 bytes | Tokens |
|---|---|---|---|
| What Permit.io isLine 9 | 0 | 584 | 125 |
| Who it is forLine 25 | 0 | 301 | 56 |
| Core problemLine 29 | 0 | 255 | 48 |
| Architecture (hybrid)Line 33 | 0 | 248 | 66 |
| Agents as first-class citizensLine 40 | 0 | 422 | 82 |
| ProductsLine 46 | 11 | 632 | 187 |
| ComplianceLine 58 | 1 | 173 | 45 |
| OptionalLine 62 · Optional | 3 | 128 | 39 |
Link counts exclude parsed fenced and inline code and resolve relative destinations against the final endpoint. Section sizes cover the text below each H2 until the next H2.
Embedded material
Code, installation and API examples
- Fenced blocks
- 0 closed
- Declared languages
- No fenced blocks detected
- Package-install commands
- 0 detected in fenced or inline code
- Authentication examples
- 0 fenced lines match API-key, Authorization, Bearer, OAuth or access-token patterns
- HTTP request examples
- 0 fenced lines match request-method patterns
- Authentication links
- 0 links have authentication-related labels
Embedded example text and links to further documentation are counted separately. A code block does not establish that a sample runs or that an authentication flow succeeds.
Publisher prioritization
The Optional section
1 H2 section named “Optional” contain 3 parsed links. 12 links sit outside those sections. That puts 20.0% of the file’s parsed links under Optional.
The community proposal uses Optional by convention for secondary links that can be skipped for a shorter context. This label does not establish that everything outside it is critical, or that the material inside it is deprecated.
Machine-readable routes
MCP references and configuration text
MCP-related text was detected in the captured file. 1 links have MCP-related labels or paths. 0 fenced lines match mcpServers, mcp_servers or an mcp add command.
- MCP Gateway ↗Source line 50
These are text and link observations. No MCP server connection, authentication or tool call was tested.
Index and bundle
llms-full.txt companion
Not established
A verified text response establishes a companion at the checked URL. It does not prove the bundle contains all product documentation, that generation is automated, or that it fits an assistant’s context window.
Change evidence
What can be said about freshness
This capture establishes a baseline. Update frequency cannot be determined from one observation.
File changes can reveal documentation edits or navigation changes. They do not by themselves measure product release velocity, accuracy, agent adoption or AI visibility.
Capture identity and measurement method
- Requested endpoint
- https://permit.io/llms.txt
- Final endpoint
- https://www.permit.io/llms.txt
- HTTP status
- 200
- Content type
- text/plain; charset=UTF-8
- Text retrieval
- Firecrawl literal text capture
- Tokenizer
- tiktoken 0.14.0 · o200k_base
- SHA-256 of saved UTF-8 text
f84eb06727feb790c3dcea10db363056f0039cb8102ccac143230f0ad990865f
Counts use a deterministic parser, not a spec-compliance grade. Unusual Markdown and indented code can fall outside its recognized patterns. See the llms.txt proposal and tokenizer implementation.