https://permitio-docs.netlify.app/assets/js/f9e3c295.bf5d62aa.js

1"use strict";(globalThis.webpackChunkmy_website||=[]).push([[5209],{55963(e,s,n){n.r(s),n.d(s,{assets:()=>l,contentTitle:()=>o,default:()=>a,frontMatter:()=>t,metadata:()=>d,toc:()=>c});const d=JSON.parse('{"id":"concepts/pdp/cloud-pdp-capabilities","title":"Cloud PDP Capabilities","description":"Reference for the Cloud PDP: supported policy models, permission check APIs, rate limits, observability, and differences from an Edge PDP.","source":"@site/docs/concepts/pdp/cloud-pdp-capabilities.mdx","sourceDirName":"concepts/pdp","slug":"/concepts/pdp/cloud-pdp-capabilities","permalink":"/concepts/pdp/cloud-pdp-capabilities","draft":false,"unlisted":false,"editUrl":"https://github.com/permitio/docs/edit/master/docs/concepts/pdp/cloud-pdp-capabilities.mdx","tags":[],"version":"current","sidebarPosition":2,"frontMatter":{"sidebar_position":2,"title":"Cloud PDP Capabilities","description":"Reference for the Cloud PDP: supported policy models, permission check APIs, rate limits, observability, and differences from an Edge PDP."},"sidebar":"concepts","previous":{"title":"Configurations","permalink":"/concepts/pdp/configuration"},"next":{"title":"Cloud PDP Benchmarks","permalink":"/concepts/pdp/cloud-pdp-benchmarks"}}');var i=n(74848),r=n(28453);const t={sidebar_position:2,title:"Cloud PDP Capabilities",description:"Reference for the Cloud PDP: supported policy models, permission check APIs, rate limits, observability, and differences from an Edge PDP."},o=void 0,l={},c=[{value:"What is the Cloud PDP?",id:"what-is-the-cloud-pdp",level:2},{value:"Supported policy models",id:"supported-policy-models",level:2},{value:"Not supported on Cloud PDP",id:"not-supported-on-cloud-pdp",level:3},{value:"Supported permission check APIs",id:"supported-permission-evaluation-types",level:2},{value:"AuthZen API endpoints",id:"authzen-api-endpoints",level:3},{value:"APIs available only on an Edge PDP",id:"container-only-helpers",level:3},{value:"Rate limiting",id:"rate-limiting",level:2},{value:"Rate limits",id:"rate-limits",level:3},{value:"Handle 429 responses",id:"handling-429-responses",level:3},{value:"Observability and logs",id:"observability--logs",level:2},{value:"Not provided by Cloud PDP",id:"not-provided-by-cloud-pdp",level:3},{value:"Data handling",id:"data-handling--scale",level:2},{value:"Cloud PDP vs Edge PDP comparison",id:"comparison-cloud-pdp-vs-container-pdp",level:2},{value:"When to use each PDP",id:"when-to-use-which",level:2},{value:"Related pages",id:"related-pages",level:2}];function h(e){const s={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.p,{children:"Look up what the Permit Cloud PDP supports: policy models, permission check APIs, rate limits, and observability. This page is for developers who decide between the Cloud PDP and a self-hosted Edge PDP, or who hit a Cloud PDP limit."}),"\n",(0,i.jsx)(s.h2,{id:"what-is-the-cloud-pdp",children:"What is the Cloud PDP?"}),"\n",(0,i.jsxs)(s.p,{children:["The Cloud PDP is the managed policy decision point (PDP) that Permit.io runs in its own infrastructure. The Cloud PDP serves authorization decisions over HTTPS at ",(0,i.jsx)(s.code,{children:"https://cloudpdp.api.permit.io"}),". It exposes the same permission check APIs as an Edge PDP (the ",(0,i.jsx)(s.code,{children:"permitio/pdp-v2"})," container you run), so an SDK connects to the Cloud PDP by setting the PDP URL."]}),"\n",(0,i.jsx)(s.p,{children:"Use the Cloud PDP when you don't want to run, upgrade, or scale PDP containers."}),"\n",(0,i.jsxs)(s.p,{children:["Use an ",(0,i.jsx)(s.a,{href:"/concepts/pdp/overview#run-an-edge-pdp-with-docker",children:"Edge PDP"})," when you need attribute-based access control (ABAC), control over network placement, or container-level configuration."]}),"\n",(0,i.jsx)(s.h2,{id:"supported-policy-models",children:"Supported policy models"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Policy model"}),(0,i.jsx)(s.th,{children:"Cloud PDP"}),(0,i.jsx)(s.th,{children:"Edge PDP"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Role-based access control (RBAC)"}),(0,i.jsx)(s.td,{children:"Supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Relationship-based access control (ReBAC)"}),(0,i.jsx)(s.td,{children:"Supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Multi-tenant authorization"}),(0,i.jsx)(s.td,{children:"Supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Attribute-based access control (ABAC)"}),(0,i.jsx)(s.td,{children:"Not supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Custom policy as code (custom Rego through GitOps)"}),(0,i.jsx)(s.td,{children:"Not supported"}),(0,i.jsx)(s.td,{children:"Supported"})]})]})]}),"\n",(0,i.jsx)(s.p,{children:"The Cloud PDP and an Edge PDP evaluate the same policy model from your Permit project. The difference is where the PDP runs and which runtime features you configure yourself."}),"\n",(0,i.jsx)(s.h3,{id:"not-supported-on-cloud-pdp",children:"Not supported on Cloud PDP"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"ABAC:"})," use an Edge PDP."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Custom policy as code:"})," use an Edge PDP with ",(0,i.jsx)(s.a,{href:"/integrations/gitops/overview",children:"GitOps"}),"."]}),"\n"]}),"\n",(0,i.jsx)(s.h2,{id:"supported-permission-evaluation-types",children:"Supported permission check APIs"}),"\n",(0,i.jsx)(s.p,{children:"The Cloud PDP serves these permission check APIs for the policy models above. The SDKs call these endpoints for you, so most applications use SDK methods instead of HTTP requests."}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Question"}),(0,i.jsx)(s.th,{children:"HTTP endpoint"}),(0,i.jsx)(s.th,{children:"Docs"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Can this user perform this action on this resource?"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /allowed"})}),(0,i.jsxs)(s.td,{children:[(0,i.jsx)(s.a,{href:"/how-to/enforce-permissions/check",children:"Check"})," (",(0,i.jsx)(s.code,{children:"permit.check()"}),")"]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Several checks in one request"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /allowed/bulk"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/how-to/enforce-permissions/bulk-check",children:"Bulk check"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"What can this user do?"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /user-permissions"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/how-to/enforce-permissions/user-permissions",children:"User permissions"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Which users can perform this action on this resource?"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /authorized_users"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/how-to/enforce-permissions/authorized-users",children:"Authorized users"})})]})]})]}),"\n",(0,i.jsx)(s.h3,{id:"authzen-api-endpoints",children:"AuthZen API endpoints"}),"\n",(0,i.jsxs)(s.p,{children:["The Cloud PDP implements the ",(0,i.jsx)(s.a,{href:"https://openid.github.io/authzen/",children:"OpenID AuthZen Authorization API 1.0"})," evaluation and search endpoints:"]}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"AuthZen operation"}),(0,i.jsx)(s.th,{children:"HTTP endpoint"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Access evaluation"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /access/v1/evaluation"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Bulk access evaluations"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /access/v1/evaluations"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Subject search"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /access/v1/search/subject"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Resource search"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /access/v1/search/resource"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Action search"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"POST /access/v1/search/action"})})]})]})]}),"\n",(0,i.jsx)(s.h3,{id:"container-only-helpers",children:"APIs available only on an Edge PDP"}),"\n",(0,i.jsx)(s.p,{children:"The Cloud PDP doesn't serve these APIs. A call to them requires an Edge PDP:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.a,{href:"/how-to/enforce-permissions/all-tenants-check",children:"All-tenants check"})," (",(0,i.jsx)(s.code,{children:"permit.checkAllTenants()"})," in Node.js, ",(0,i.jsx)(s.code,{children:"permit.AllTenantsCheck()"})," in Go)."]}),"\n",(0,i.jsxs)(s.li,{children:["Local APIs under ",(0,i.jsx)(s.code,{children:"/local/"}),", such as ",(0,i.jsx)(s.code,{children:"/local/role_assignments"}),". See ",(0,i.jsx)(s.a,{href:"/how-to/enforce-permissions/list-role-assignments",children:"List role assignments"}),"."]}),"\n"]}),"\n",(0,i.jsx)(s.h2,{id:"rate-limiting",children:"Rate limiting"}),"\n",(0,i.jsx)(s.p,{children:"The Cloud PDP applies rate limits to protect the shared service. You don't configure the limits."}),"\n",(0,i.jsx)(s.h3,{id:"rate-limits",children:"Rate limits"}),"\n",(0,i.jsxs)(s.p,{children:["The Cloud PDP counts requests per client IP address over a 1-minute window. When a client exceeds a limit, the Cloud PDP returns HTTP ",(0,i.jsx)(s.code,{children:"429 Too Many Requests"}),"."]}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Endpoint"}),(0,i.jsx)(s.th,{children:"Method"}),(0,i.jsx)(s.th,{children:"Limit"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"/allowed/bulk"})}),(0,i.jsx)(s.td,{children:"POST"}),(0,i.jsx)(s.td,{children:"200 req/min"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"/access/v1/evaluations"})}),(0,i.jsx)(s.td,{children:"POST"}),(0,i.jsx)(s.td,{children:"200 req/min"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"/access/v1/search/*"})}),(0,i.jsx)(s.td,{children:"POST"}),(0,i.jsx)(s.td,{children:"300 req/min"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"/u

1ser-permissions"})}),(0,i.jsx)(s.td,{children:"POST"}),(0,i.jsx)(s.td,{children:"500 req/min"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"/authorized_users"})}),(0,i.jsx)(s.td,{children:"POST"}),(0,i.jsx)(s.td,{children:"500 req/min"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"/allowed"})}),(0,i.jsx)(s.td,{children:"POST"}),(0,i.jsx)(s.td,{children:"1000 req/min"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"/access/v1/evaluation"})}),(0,i.jsx)(s.td,{children:"POST"}),(0,i.jsx)(s.td,{children:"1000 req/min"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"All POST requests"}),(0,i.jsx)(s.td,{children:"POST"}),(0,i.jsx)(s.td,{children:"1500 req/min"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"All requests"}),(0,i.jsx)(s.td,{children:"Any"}),(0,i.jsx)(s.td,{children:"3000 req/min"})]})]})]}),"\n",(0,i.jsx)(s.p,{children:"When a client exceeds a rate limit, the response body is:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-json",children:'{\n  "error": "rate_limited",\n  "message": "You have exceeded the rate limit. Please try again later."\n}\n'})}),"\n",(0,i.jsx)(s.admonition,{title:"Shared public IP addresses",type:"note",children:(0,i.jsxs)(s.p,{children:["The limits are set to accommodate corporate networks where many users share one public IP address. If a large deployment behind a shared IP address receives ",(0,i.jsx)(s.code,{children:"429"})," responses, email ",(0,i.jsx)(s.a,{href:"mailto:[email protected]",children:"[email protected]"}),"."]})}),"\n",(0,i.jsx)(s.h3,{id:"handling-429-responses",children:"Handle 429 responses"}),"\n",(0,i.jsxs)(s.p,{children:["When your application receives an HTTP ",(0,i.jsx)(s.code,{children:"429"})," response from the Cloud PDP:"]}),"\n",(0,i.jsxs)(s.ol,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Check the response body."})," An ",(0,i.jsx)(s.code,{children:'"error": "rate_limited"'})," body confirms a rate limit, not an application error."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Retry with backoff."})," Wait a few seconds, then retry the request."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Reduce concurrency."})," If several services share one public IP address, reduce their parallel requests, or use ",(0,i.jsx)(s.code,{children:"/allowed/bulk"})," to combine checks."]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"If your workload needs a higher request rate than these limits, run an Edge PDP. An Edge PDP has no built-in rate limits."}),"\n",(0,i.jsx)(s.h2,{id:"observability--logs",children:"Observability and logs"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Decision logs:"})," the Cloud PDP sends decision logs to Permit. They appear in the ",(0,i.jsx)(s.strong,{children:"Audit Logs"})," screen and the audit log APIs in the same format as logs from an Edge PDP."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Debug Mode:"})," Debug Mode adds context to decision logs. For the Cloud PDP, you enable Debug Mode through the PDP configuration of your environment with the Permit API. You don't run or configure a Cloud PDP container. See ",(0,i.jsx)(s.a,{href:"/how-to/use-audit-logs/debug-mode",children:"Debug Mode"}),"."]}),"\n"]}),"\n",(0,i.jsx)(s.h3,{id:"not-provided-by-cloud-pdp",children:"Not provided by Cloud PDP"}),"\n",(0,i.jsx)(s.p,{children:"The Cloud PDP is a managed service, so it doesn't expose these container-level features:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["A ",(0,i.jsx)(s.code,{children:"/metrics"})," endpoint or a custom metrics sink."]}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.a,{href:"/how-to/use-audit-logs/logs-forwarder",children:"logs forwarder"})," (Fluent Bit) configuration."]}),"\n",(0,i.jsx)(s.li,{children:"Access to the underlying OPA process, OPAL services, or internal logs."}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["To monitor Cloud PDP usage, use the ",(0,i.jsx)(s.strong,{children:"Audit Logs"})," screen, and add metrics and logging around the PDP calls in your application."]}),"\n",(0,i.jsx)(s.h2,{id:"data-handling--scale",children:"Data handling"}),"\n",(0,i.jsx)(s.p,{children:"Permit manages policy and data ingestion, replication, and storage for the Cloud PDP, and operates the service: patching, upgrades, and tuning. With an Edge PDP, you own that lifecycle: image upgrades, rollout strategy, and observability stack."}),"\n",(0,i.jsx)(s.p,{children:"The Cloud PDP reads only the data you store in Permit: users, tenants, resource instances, relationship tuples, and role assignments. You can't configure OPAL Scopes or custom data sources for the Cloud PDP."}

1),"\n",(0,i.jsx)(s.p,{children:"Use an Edge PDP if you need any of these:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Custom external data sources through OPAL Scopes. See ",(0,i.jsx)(s.a,{href:"/how-to/manage-data/use-external-data-source",children:"Use an external data source"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:["Read-your-own-writes with ",(0,i.jsx)(s.a,{href:"/how-to/manage-data/local-facts-uploader",children:"Send Consistent Updates"}),"."]}),"\n",(0,i.jsx)(s.li,{children:"Offline mode, backups, or control over the network path to Permit."}),"\n"]}),"\n",(0,i.jsx)(s.h2,{id:"comparison-cloud-pdp-vs-container-pdp",children:"Cloud PDP vs Edge PDP comparison"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Capability"}),(0,i.jsx)(s.th,{children:"Cloud PDP"}),(0,i.jsxs)(s.th,{children:["Edge PDP (",(0,i.jsx)(s.code,{children:"permitio/pdp-v2"}),")"]})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Deployment"}),(0,i.jsx)(s.td,{children:"Managed by Permit"}),(0,i.jsx)(s.td,{children:"You run and operate the container image"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Policy models"}),(0,i.jsx)(s.td,{children:"RBAC, ReBAC"}),(0,i.jsx)(s.td,{children:"RBAC, ReBAC, ABAC"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Multi-tenant authorization"}),(0,i.jsx)(s.td,{children:"Supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Single and bulk checks, user permissions, authorized users"}),(0,i.jsx)(s.td,{children:"Supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"AuthZen API"}),(0,i.jsx)(s.td,{children:"Supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"All-tenants check"}),(0,i.jsx)(s.td,{children:"Not supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsxs)(s.td,{children:["Local APIs (",(0,i.jsx)(s.code,{children:"/local/*"}),")"]}),(0,i.jsx)(s.td,{children:"Not supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"External data through OPAL Scopes"}),(0,i.jsx)(s.td,{children:"Not supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Debug Mode configuration"}),(0,i.jsx)(s.td,{children:"Environment PDP configuration through the Permit API"}),(0,i.jsxs)(s.td,{children:["Environment PDP configuration, or the ",(0,i.jsx)(s.code,{children:"PDP_DEBUG"})," environment variable per container"]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Logs forwarder (Fluent Bit)"}),(0,i.jsx)(s.td,{children:"Not supported"}),(0,i.jsx)(s.td,{children:"Supported"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Metrics and APM"}),(0,i.jsx)(s.td,{children:"Not supported"}),(0,i.jsxs)(s.td,{children:[(0,i.jsx)(s.code,{children:"/metrics"})," endpoint and Datadog APM tracing"]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Updates and maintenance"}),(0,i.jsx)(s.td,{children:"Operated by Permit"}),(0,i.jsx)(s.td,{children:"You manage image versions, rollouts, and maintenance"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Send Consistent Updates (read-your-own-writes)"}),(0,i.jsx)(s.td,{children:"Not supported"}),(0,i.jsxs)(s.td,{children:["Supported with ",(0,i.jsx)(s.code,{children:"proxy_facts_via_pdp"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"Rate limiting"}),(0,i.jsx)(s.td,{children:"Built in, per IP address"}),(0,i.jsx)(s.td,{children:"None built in"})]})]})]}),"\n",(0,i.jsx)(s.h2,{id:"when-to-use-which",children:"When to use each PDP"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.strong,{children:"Use the Cloud PDP when:"})}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"You want a managed PDP without containers to operate."}),"\n",(0,i.jsx)(s.li,{children:"Your policies use RBAC and ReBAC."}),"\n",(0,i.jsxs)(s.li,{children:["You call the standard check APIs: ",(0,i.jsx)(s.code,{children:"/allowed"}),", ",(0,i.jsx)(s.code,{children:"/allowed/bulk"}

1),", ",(0,i.jsx)(s.code,{children:"/user-permissions"}),", ",(0,i.jsx)(s.code,{children:"/authorized_users"}),", and the AuthZen endpoints."]}),"\n",(0,i.jsxs)(s.li,{children:["Your request rate fits within the ",(0,i.jsx)(s.a,{href:"#rate-limits",children:"rate limits"}),"."]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.strong,{children:"Use an Edge PDP when:"})}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"You need ABAC."}),"\n",(0,i.jsx)(s.li,{children:"You need control over deployment topology, networks, and scaling."}),"\n",(0,i.jsx)(s.li,{children:"You depend on local APIs, custom data sources, read-your-own-writes, or container-level observability."}),"\n"]}),"\n",(0,i.jsx)(s.h2,{id:"related-pages",children:"Related pages"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.a,{href:"/concepts/pdp/overview",children:"PDP overview"}),": connect an SDK to the Cloud PDP or run an Edge PDP."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.a,{href:"/concepts/pdp/cloud-pdp-benchmarks",children:"Cloud PDP benchmarks"}),": server-side latency measurements."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.a,{href:"/concepts/pdp/configuration",children:"PDP configuration"}),": environment variables for an Edge PDP."]}),"\n"]})]})}function a(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},28453(e,s,n){n.d(s,{R:()=>t,x:()=>o});var d=n(96540);const i={},r=d.createContext(i);function t(e){const s=d.useContext(r);return d.useMemo(function(){return"function"==typeof e?e(s):{...s,...e}},[s,e])}function o(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:t(e.components),d.createElement(r.Provider,{value:s},e.children)}}}]);