Skip to main content

Feature Parity

Capability-by-capability comparison between the container PDP (permitio/pdp-v2) and the New Edge PDP (permitio/pdp-v3).

The New Edge PDP is wire-compatible on the endpoints it implements — same paths, same request and response shapes, so existing SDK integrations that use those endpoints work unchanged. But it implements a subset of the container PDP's surface.

Its capability envelope is that of the managed Cloud PDP, deployed in your own network — not a port of the pdp-v2 container.

✅ Supported · 🚧 On the roadmap · ❌ Not supported

CapabilityContainer PDPNew Edge PDP
Check — POST /allowed✅✅
  └ RBAC✅✅
  └ ReBAC, including role derivation✅✅
  └ Multi-tenancy✅✅
  └ ABAC — condition, user and resource sets✅❌
Bulk check — POST /allowed/bulk✅✅
User permissions — POST /user-permissions✅✅
Authorized users — POST /authorized_users✅✅
All-tenants check — POST /allowed/all-tenants✅❌
URL-based enforcement — POST /allowed_url✅❌
AuthZen access evaluation — POST /access/v1/evaluation✅✅
AuthZen bulk evaluations — POST /access/v1/evaluations✅✅
AuthZen subject / resource / action search✅✅
AuthZen discovery — GET /.well-known/authzen-configuration✅✅
Policy-as-Code / custom Rego bundles✅❌
Local facts / read-your-own-writes✅❌
Local enforcement APIs — /local/*✅❌
Custom data sources✅❌
Kong and nginx integration✅❌
Offline / air-gapped first boot✅❌
Decision logs to Permit✅✅
Health and readiness endpoints✅✅
Prometheus metrics — GET /metrics✅❌
OpenTelemetry (OTLP traces, metrics, logs)❌🚧

Notes on specific rows​

Data filtering. Filtering through the information graph — /user-permissions and /authorized_users — works on both PDPs, and covers most "which resources can this user see?" cases. See Data Filtering for the available approaches.

Offline first boot. A New Edge PDP that cannot reach the control plane on its first boot cannot start. Once it has started, it survives control-plane outages indefinitely, serving decisions from its local copy.

ABAC. A check evaluated against an ABAC policy returns a deny on the New Edge PDP rather than an error. If your policies use condition sets, user sets, or resource sets, use the container PDP.

Contents