In-process TypeScript, not a network PDP

Libraries that share a problem space, hosted PDPs that sit on the wire, and policy languages with their own schemas. The full write-up is in the docs.

Full comparison Landscape

Typed references

No string keys in the public API.

Portable conditions

Memory, SQL and RLS from one AST.

Optional Cloud

Never on the decision path.

permix

In-process library

Closest adapter breadth. Mutable global core, boolean hydration, no explain, no SQL.

CASL v7

In-process library

Mature conditions to Prisma and Mongoose. String tuples, no Standard Schema, no MCP.

Kilpi v1

In-process library

Server-first Grant and Deny. Zod and superjson in core, no Standard Schema, RN or MCP.

Better Auth access control

Auth-bound RBAC

Typed RBAC bound to Better Auth. PermDock layers conditions, snapshots and adapters on top.

Hosted PDPs

Network PDP

Cerbos, Permit.io, OpenFGA, SpiceDB, Oso Cloud: strings in, boolean out. PermDock embeds and can speak AuthZEN to them.

Cedar and OPA

Policy language

Separate languages with their own schemas. PermDock keeps policy as TypeScript data.

Zanzibar family

Relation graph

OpenFGA, SpiceDB, Auth0 FGA, WorkOS FGA. PermDock does not store tuples; it can PEP in front.

Feature	PermDock	Typical library	Hosted PDP
Typed permission references	Yes	String keys or tuples	Strings on the wire
Standard Schema resources	Yes	Rare	No
Portable conditions to SQL and RLS	Yes	CASL to Prisma only	Query plans, not your AST
Three-outcome Decision	granted, denied, approval-required	Boolean	ALLOW or DENY
In-process, no network to decide	Yes	Yes	No
MCP, AI SDK, Eve, OpenAI Agents	First-class adapters	None or fail-open	Proxy or guide
Optional Cloud on the decision path	Never	N/A	The product is the path