# Permit.io MCP for AI Agents AI Agent Connect > Permit.io lets you manage your application's authorization layer using natural language. It connects your AI agent to your permissions schema, allowing you to evaluate access, define roles, and provision user facts without writing manual code. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_h7lEgaGgidbqX25uXlKdq3dJ0i9YUQLmCut1E4p9/ai-agent-connect - **Tags:** authorization, rbac, rebac, abac, policy-as-code, access-control ## Description This Connector lets you manage your application's authorization layer through natural language. You can evaluate permissions, manage your authorization schema, and handle user facts without touching code. It puts your Permit.io account into the hands of your AI agent, making it easy to build out complex access control structures like RBAC or ReBAC. Whether you're defining roles, provisioning users, or checking access, you can do it all through a conversation. It's a lot faster than clicking through a dashboard or writing manual scripts. You'll find it's a great way to keep your permission data in sync while maintaining full control over your security policies. Using this with the Vinkius catalog allows you to move from manual configuration to conversational management without losing any of the granular control your security team requires. Instead of wrestling with complex permission logic or manually updating thousands of user records, you can just describe what you want to happen. Your AI agent handles the heavy lifting of interacting with the API, ensuring your security posture remains consistent and up to date. This means security engineers can audit policies in seconds and developers can verify access logic during the build phase without leaving their tools. ## Tools ### create_tenant Create a new tenant fact. Use this to partition your authorization data. ### authzen_subject_search Search for subjects in AuthZen. This helps identify who has what access. ### bulk_assign_roles Assign roles to many users at once. It handles up to 2,000 assignments in one go. ### bulk_create_tenants Create up to 2,000 tenants at once. This is perfect for large-scale data migrations. ### bulk_create_users Create up to 3,000 users at once. Use this to seed your authorization environment. ### bulk_relationship_tuples Create up to 1,000 relationship tuples at once. This helps build out ReBAC structures quickly. ### create_resource Add a new resource to your schema. This helps organize what your users can actually interact with. ### create_role Define a new role for your application. This sets the foundation for who can do what. ### create_user Create a new user fact. This links specific identities to your permission logic. ### authzen_access_evaluation Run an AuthZen access evaluation. It checks permissions against the AuthZen standard. ### authzen_action_search Search for actions within AuthZen. This helps find specific permissions quickly. ### authzen_bulk_evaluations Run multiple AuthZen evaluations at once. It's great for batch-checking permissions. ### authzen_resource_search Search for resources in AuthZen. Use this to find specific items in your security schema. ### assign_permissions_to_role Link permissions to a specific role. This defines the capabilities of that role. ### assign_role_to_user Give a user a specific role within a tenant. This is the standard way to grant access. ### check_permission Verify if a user can perform a specific action. This is the primary tool for permission testing. ### create_relation Build a ReBAC relation between resources. It helps define complex ownership structures. ### create_relationship_tuple Create a single ReBAC relationship tuple. Use this to define specific links between entities. ## Prompt Examples **Prompt:** ``` Can my user 'jane@company.com' delete the 'production_server' in the 'us-east' tenant? ``` **Response:** ``` I've checked the permissions for you. **User:** jane@company.com **Action:** delete **Resource:** production_server **Tenant:** us-east ✅ **Permitted**: The user has the necessary permissions to perform this action. ``` **Prompt:** ``` Create a new 'editor' role and give it read and write permissions for the 'content' resource. ``` **Response:** ``` I've updated your schema: * **New Role:** editor * **Permissions:** * `content:read` * `content:write` The 'editor' role is now ready for use. ``` **Prompt:** ``` I need to move 500 users to the 'premium' role. Can you do that for me? ``` **Response:** ``` I'm starting the bulk update now. * **Operation:** Bulk assign roles * **Role:** premium * **Count:** 500 users I'll let you know as soon as the update is complete. ``` ## Capabilities ### Check user permissions Verify if a specific user has the right to perform an action on a resource. ### Build roles and resources Create and organize the core components of your authorization schema. ### Sync user and tenant facts Provision and update user data to keep your permission logic accurate. ### Run AuthZen evaluations Execute standardized access checks using the AuthZen framework. ### Create complex relationship tuples Define ownership and hierarchical links for ReBAC structures. ## Use Cases ### Verifying permission logic during development A developer asks the agent to check if a 'guest' user can 'delete' a 'file' resource using `check_permission` to verify the logic before merging code. ### Onboarding new tenants at scale An ops lead asks the agent to create 500 new tenants and assign a 'base_user' role to all of them using `bulk_create_tenants` and `bulk_assign_roles`. ### Security auditing for unauthorized access A security lead asks the agent to find all users with 'admin' actions using `authzen_subject_search` to identify potential risks. ### Rapid role prototyping for new features A product manager asks the agent to create an 'editor' role and assign 'read' and 'write' permissions to it using `assign_permissions_to_role`. ## Benefits - Stop hunting through documentation by using `check_permission` to get instant answers on user access. - Build complex ReBAC structures faster by using `create_relation` and `create_relationship_tuple` via chat. - Handle large-scale migrations easily with `bulk_create_users` and `bulk_create_tenants` for up to 3,000 records. - Sync your environment instantly using `create_user` and `create_tenant` to keep permissions accurate. - Audit your security posture quickly with `authzen_bulk_evaluations` to check multiple permissions at once. ## How It Works The bottom line is you get a conversational interface for your entire authorization schema. 1. Subscribe to the Permit.io MCP on Vinkius. 2. Enter your API key and optional PDP URL in your AI client. 3. Start asking your AI client to manage roles, check permissions, or sync user facts. ## Frequently Asked Questions **How do I use Permit.io to manage my app's permissions?** You connect your Permit.io account to your AI agent using this Connector. Once connected, you can use natural language to create roles, check permissions, and manage your entire authorization schema. **Can Permit.io handle ReBAC for complex ownership?** Yes, it handles ReBAC by allowing you to define and manage complex relationships between resources, such as ownership or hierarchical access, through the Connector. **How can I bulk update user roles with Permit.io?** You can ask your AI agent to perform bulk assignments. The Connector supports assigning roles to up to 2,000 users at once, making large migrations much faster. **Can I use Permit.io to audit my existing security policies?** Absolutely. You can use the Connector to search for specific subjects, actions, or resources to audit who has access to what across your entire environment. **How does Permit.io sync user facts with my AI agent?** The Connector provides tools to create and update user facts directly. This ensures that the data your AI agent uses to evaluate permissions stays in sync with your actual user base. **Is Permit.io good for managing multi-tenant permissions?** Yes, it is designed for multi-tenancy. You can create, manage, and partition tenant facts and permissions independently for each of your customers. **How do I check if a specific user has permission to access a resource?** Use the `check_permission` tool. You need to provide the user identifier, the action (e.g., 'read'), and the resource object (including type and tenant). The agent will query your PDP and return the authorization decision. **Can I create new roles and assign permissions to them using this server?** Yes. You can use `create_role` to define a new role in your schema and then use `assign_permissions_to_role` to specify exactly what that role is allowed to do within a project and environment. **Does this integration support AuthZen standards?** Yes, it includes several tools like `authzen_access_evaluation` and `authzen_bulk_evaluations` to perform authorization checks following the AuthZen specification.