# Permify MCP for AI Agents AI Agent Connect > Permify lets you manage complex authorization rules and fine-grained access control using natural language. You can write schemas, handle relation tuples, and run real-time permission checks for multi-tenant environments. It connects your IAM infrastructure directly to your AI agent for faster auditing and policy management. It's a professional way to handle ReBAC and ABAC models without the friction of manual updates. ## Overview - **Category:** developer-tools - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_Lj3zVVVKVoHoqSvO650xPkcUTwv8Ivlhnr8cxNaW/ai-agent-connect - **Tags:** iam, authorization, rbac, abac, rebac, access-control ## Description Permify lets you manage complex authorization rules and fine-grained access control using natural language. Most security teams get stuck scrolling through nested JSON files or clicking through a messy dashboard of roles to find out who can do what. This Connector changes that by letting you talk to your security logic like a human. You can just tell your AI agent what the new rule is, and it handles the logic in one command instead of requiring multiple manual updates. It understands how users relate to resources and ensures that your security stays tight even as your user base grows. If you need to figure out why a specific user can't see a document or you're spinning up a new client environment, this Connector gives your agent the eyes it needs to see your entire authorization graph. It saves the time usually spent on manual IAM overhead. You'll find this sitting right alongside other powerful integrations in the Vinkius catalog, making it a go-to for keeping your access controls organized and accurate without the usual headache of manual API calls. ## Tools ### list_tenants See every tenant currently in your Permify instance. Use this to get a bird's-eye view of your multi-tenant setup. ### lookup_entity Find out which resources a specific user can actually access. It helps you debug permission denied issues quickly. ### lookup_subject Identify which subjects are allowed to perform an action on a specific entity. Use this to audit specific resource access. ### read_attributes Query the attributes stored in your system. Use this to see the metadata behind your permission tuples. ### read_bundle Get the details of a specific data bundle. This is helpful for inspecting predefined permission sets. ### read_relationships Query the stored relational tuples. Use this to see the raw links between users and resources. ### read_schema Inspect a specific version of an authorization schema. This is how you verify the current state of your models. ### check_permission Perform a single resource-based authorization check. Use this to see if a specific user can perform a specific action. ### create_tenant Create a brand new Permify tenant. This helps you isolate different client environments instantly. ### delete_bundle Remove a predefined bundle of data. Use this to clean up old permission sets or temporary configurations. ### delete_data Delete specific relation tuples and attributes. This is useful for removing outdated user-to-resource links. ### delete_tenant Delete an entire Permify tenant. Use this to decommission old client environments or test environments. ### expand_permissions See every subject that has a relationship with a specific entity. It helps you map out complex permission webs. ### list_schemas See all the schema versions for a specific tenant. This is your go-to for checking the history of your auth models. ### run_bundle Execute a predefined bundle of data. Use this to quickly apply a set of permissions across your system. ### subject_permission List every permission a user has on a specific entity. This is perfect for showing a user their own access rights. ### write_bundle Define or update data bundles. Use this to create reusable sets of permissions for different roles. ### write_data Create new relation tuples and attribute data. Use this to link users to resources and attributes in seconds. ### write_schema Write a completely new authorization model schema. Use this to set up the foundation for your permissions. ### bulk_check_permissions Check multiple permissions in one go to save time. It's great for verifying large batches of access rights quickly. ### partial_write_schema Update just one part of an authorization model. This lets you make surgical changes to your DSL without rewriting everything. ## Prompt Examples **Prompt:** ``` Check if user 'user:123' has 'edit' permission on 'document:doc-001' in tenant 'default'. ``` **Response:** ``` I've checked the permissions for you. The result is **ALLOWED**. User 123 has the necessary edit rights for that document. ``` **Prompt:** ``` List all schema versions for tenant 'production-v1'. ``` **Response:** ``` I've pulled the history for 'production-v1'. There are 3 versions available: * v1 * v2 * v20231027-01 (Latest) Would you like me to inspect the details of the latest version? ``` **Prompt:** ``` Create a new tenant called 'client-alpha-test'. ``` **Response:** ``` I've created that for you. The new tenant 'client-alpha-test' is now live with ID `cat-9920`. You can start defining its authorization schema now. ``` ## Capabilities ### Run permission checks Ask the agent to verify if a user has access to a specific resource instantly. ### Create new tenants Spin up isolated environments for different clients without manual configuration. ### Audit relationships See exactly who has access to what by expanding permission graphs. ### Update authorization schemas Modify your DSL models to reflect new business requirements on the fly. ### Bulk validate permissions Check dozens of permission rules at once to ensure consistency across your app. ## Use Cases ### Auditing a security breach A security engineer needs to know who has access to a leaked document. They ask the agent to use `expand_permissions` to list every subject with a relationship to that entity. ### Rapid tenant onboarding A DevOps lead needs to set up a new client. They tell the agent to use `create_tenant` and `write_schema` to get the new environment live in seconds. ### Debugging Access Denied A developer can't figure out why a user can't edit a page. They ask the agent to use `lookup_entity` to see all resources the user can actually touch. ### Bulk permission updates A product manager wants to grant a new role access to 50 different documents. They ask the agent to use `write_data` to batch update those relationships. ## Benefits - Stop manual auditing by using `expand_permissions` to see every user with access to a resource in one command. - Faster multi-tenancy by using `create_tenant` and `list_tenants` to manage client environments without touching the CLI. - Easier debugging with `lookup_entity` and `lookup_subject` to instantly find out why a user is blocked from a resource. - Precise schema updates using `partial_write_schema` so you don't have to overwrite your entire authorization model every time. - Rapid data entry using `write_data` to link users to resources and attributes in seconds instead of manual database entries. ## How It Works The bottom line is that you get to manage complex security policies using plain English instead of manual configuration. 1. Connect your Permify API URL and Secret Token to the Connector. 2. Describe the permissions or schema changes you need to the agent. 3. Get instant confirmation or automated updates to your IAM infrastructure. ## Frequently Asked Questions **Can the Permify MCP help me audit user permissions?** Yes, it allows your agent to see every subject that has a relationship with a specific entity. This makes it easy to spot unauthorized access or find out exactly who can see your data. **How does Permify MCP handle multiple clients?** It manages isolated environments for different clients. You can use the agent to create, list, and delete these tenants so each client stays completely separated. **Can I use this to update my security rules without a redeploy?** Yes, you can use the agent to partially update your authorization models. This means you can change specific rules on the fly without having to push new code to your servers. **Does Permify MCP support complex access controls like ReBAC?** It's designed specifically for that. It handles relationship-based and attribute-based access control, letting you define complex rules like 'users can edit documents if they are the owner or a member of the team.' **Can my agent check permissions for a large group of users?** Yes, the Connector includes a way to perform bulk permission checks. This is perfect for verifying that a whole group of users has the correct access rights at once. **Is it easy to see who has access to a specific resource?** Absolutely. You can ask your agent to expand the permissions for any entity, and it will list every person or group that has a relationship with it. **Can I check permissions for multiple users or resources at once?** Yes! Use the `bulk_check_permissions` tool. It allows you to send a list of check requests in a single call, making it efficient for auditing complex views or batch processing. **How do I update only a small part of my authorization model?** You can use the `partial_write_schema` tool. Instead of overwriting the entire model, you provide a map of entity updates to modify specific parts of your schema. **Is it possible to manage isolated environments for different customers?** Absolutely. Use the `create_tenant` tool to spin up new isolated authorization silos. You can then use `list_tenants` to keep track of all active environments.