As KubeCon + CloudNativeCon North America 2024 approaches, the focus on security and authorization within cloud-native applications is stronger than ever. Permit.io, a leader in fine-grained authorization solutions, is once again taking center stage at the event. In this Q&A, VMblog sits down with Gabriel L. Manor, VP of Developer Relations of Permit.io to discuss the company’s innovative platform, their continued sponsorship of KubeCon, and their exciting plans for this year’s event.
Permit.io is transforming the way developers manage authorization, offering a powerful platform that integrates seamlessly into the software development lifecycle.
Join us as we dive into what makes Permit.io stand out in the cloud-native ecosystem and what attendees can look forward to at their booth this year.
VMblog: If you are giving a KubeCon attendee a quick overview of the company, what would you say? How would you describe the company?
Gabriel L. Manor: Permit.io is a platform that helps developers implement fine-grained authorization in their applications. Permit is not just a policy engine that provides decisions; it’s a platform that places the developer as a first-class citizen and understands that authorization involves many business use cases and the way data is modeled in the application. Permit.io offers fine-grained authorization solutions, as well as UI components that help implement authorization experiences, the best authorization audit logs in the industry, and the ability to configure any type of fine-grained authorization model – from RBAC, ABAC, and ReBAC to policy-based access control. Permit also emphasizes the software development lifecycle and creates a great automated experience for developers looking to integrate authorization into their software development lifecycle.
VMblog: Your company is sponsoring this year’s KubeCon and CloudNativeCon event. Can you talk about what the sponsorship looks like?
Manor: This is not actually the first KubeCon we are sponsoring. We’ve been sponsoring KubeCon for three years in a row now. It was the first event we sponsored as a company. The thing we especially love about KubeCon is the diverse backgrounds of the attendees. You can find anyone here, from IT architects to DevOps developers, cloud developers, application developers, engineers, leaders, executives, and more. This variety helped us immensely in listening to users and understanding how we can tailor Permit to everyone’s needs.
VMblog: How can attendees of the event find you? What do you have planned at your booth this year? What can attendees do at your booth?
Manor: Permit is known for a really cool and engaging booth experience. We are not trying to sell or gather leads; we’re trying to engage with the community. We see the conference as a two-way experience. Developers want to understand what they can do with Permit, and we want to learn what we can do better with our platform. As a developer tool, we always have more to learn – we see developers as the perfect audience to help us improve. We will be at booth Q60, and anyone who comes by is welcome to join us. We have a raffle for a customized Permit keyboard, and limited-edition puzzles, and other fun swag you can take home with you. You’re also welcome to get a demo of Permit, or schedule a time with us for a customized demo that suits your application’s particular needs.
VMblog: Have you sponsored KubeCon and CloudNativeCon in the past? If so, what is it about this show that keeps you coming back as a sponsor?
Manor: As I mentioned earlier, we love the diverse backgrounds of the audience. We love listening to developers and learning about new use cases and challenges Permit can address. We are also always looking for open-source collaborations, as Permit has multiple open-source projects. Permit’s Core Engine, OPAL (Open Policy Administration Layer), helps many CNCF-backed projects like Open Policy Agent and OpenFGA to function better for application authorization. We really enjoy meeting the open-source community and exploring how we can collaborate more effectively.
VMblog: What do you attribute to the success and growth of this industry?
Manor: Fine-grained authorization is still a relatively young area for application product developers, and Permit.io is proud to lead the industry, educating others and ensuring everyone knows the options available for authorization in their applications. We do that by working hard on market education by creating tons of fine-grained authorization-related content, and diving into the technical details within the industry.
VMblog: Do you have any speaking sessions during the event? If so, can you give us the details?
Manor: Yes, we have a panel called the “Policy Engine Showdown.” There are many policy engines out there. Permit is policy-agnostic, which allows us to remain neutral about the policy engine itself. In this panel, we will feature participants from Open Policy Agent, AWS Cedar, OpenFGA, Topaz (built on top of Open Policy Agent), and an end-user from a company that has implemented relationship-based access control. It’s going to be an interesting session for anyone considering fine-grained authorization but unsure about which engine to use.
VMblog: What are you personally most interested in seeing or learning at KubeCon and CloudNativeCon?
Manor: As you might expect, fine-grained authorization and security are at the top of my list. I’m eager to see interesting use cases involving fine-grained authorization in LLM and AI applications. I’m also thrilled to see how WASM (WebAssembly) is opening up opportunities for better fine-grained authorization in products. It’s always exciting to see more projects at KubeCon focused on permissions and access control, along with existing ones like Open Policy Agent, Keycloak, OpenFGA, and others.
VMblog: What kind of message will attendees hear from you this year? What will they take back to help their senior management team and decision-makers?
Manor: The main message is that if you need fine-grained authorization, you don’t need to worry about the engine. If you’ve ever implemented fine-grained authorization, you know that the engine is critical, but you also need a platform on top of that. Permit provides this platform. Our platform integrates with the SDLC, and offers policy modeling through Terraform, policy-as-code, or via the UI and API. We have APIs to manage all authorization, a UI for non-developer stakeholders who need to interact with permissions, and audit and decision logs that can help identify trends and anomalies. We also provide components to help implement a better fine-grained authorization experience. One of the unique aspects of Permit is that some of our features can drive revenue by enhancing security.
VMblog: Can you elaborate on your core technologies and talk about the types of problems you’ve solved for KubeCon CloudNative attendees?
Manor: By being policy-agnostic, Permit gives developers the freedom to design the best experience for fine-grained access control. For example, our open-source project, OPAL (Open Policy Administration Layer), helps developers who want to implement fine-grained authorization using OpenFGA or Open Policy Agent (OPA) without writing all the boilerplate code themselves. Permit takes care of that, allowing developers to focus on what matters most. Many KubeCon attendees have some connection to permissions or authorization, and we believe everyone can find something useful at our booth.
VMblog: Thinking about your company’s solutions, can you give readers three examples of how your offerings are unique? What are your differentiators? What sets you apart from the competition?
Manor: We are an end-to-end platform. You don’t need to worry about integrating any other technology when using Permit. While some competitors offer great engines or implementations, none of them provide a complete, end-to-end service that is a one-stop shop for every authorization need. Our main differentiator is that we don’t lock you into using Permit, as it is built as a modular platform. If you decide you want to manage your own policy engine, you can just take the policy code we generate and handle it yourself. If you want to sync everything yourself, you can use our open-source projects to do so. We allow developers flexibility without locking them into a specific vendor.
VMblog: Where does your company fit within the container, cloud, and Kubernetes ecosystem?
Manor: Our company addresses a unique need within the Kubernetes and cloud ecosystem. In the past, authorization in monolithic applications could be handled by a single service that you queried for permission. In microservice and cloud-native architectures, especially with the volume of data being loaded, you need much more than just querying for permissions. Our solution is specifically designed for these complex architectures.
VMblog: KubeCon + CloudNativeCon is typically a great event for companies to launch new products or updates to existing projects. Will your company be announcing something new? If so, can you give us a sneak preview?
Manor: Yes, we have a big announcement coming at KubeCon that will strengthen our position in the policy engine space. We’ll be introducing something new that is available both as an open-source project and as part of our SaaS product. This new feature will offer users a different way to model and enforce authorization in their applications. Stay tuned for more details!
VMblog: With regard to containers and Kubernetes, is there anything holding them back from wider adoption? If so, what is it, and how can we overcome it?
Manor: Security has traditionally been one of the main factors preventing wider adoption of cloud-native models, particularly Kubernetes. However, we believe that cloud-native architectures, when properly implemented, are far more secure than on-premise solutions. While hybrid architectures can sometimes be more vulnerable, following best practices and implementing security features like fine-grained authorization can mitigate most risks. We truly believe that cloud-native technologies are here to stay and will only continue to grow.
VMblog: Are companies going all-in on the cloud, or do you see a return to on-premises solutions? Are there roadblocks keeping companies from going fully cloud-based? If so, how can they address these challenges?
Manor: That’s a great question. Going fully cloud-based is absolutely viable, and the ecosystem can support almost everything. However, some organizations are trying to return to on-premises solutions, although even these deployments are often cloud-native in architecture. More vulnerabilities are emerging in hybrid setups, but we are working hard with our product to solve the unique challenges of hybrid architectures, like the new attack surfaces created between cloud and on-premise systems. With best practices and the adoption of security features like fine-grained authorization, many organizations can overcome these challenges and embrace cloud-native models.
VMblog: The keynote stage will cover a number of big topics. What major changes or trends do you see taking shape for 2025?
Manor: AI and LLMs are becoming more accessible for full-stack and cloud-native applications. Currently, you often need to be an AI engineer to work with them, but they are becoming much more approachable for everyone. What excites us the most is how technologies that were traditionally limited to enterprise-level applications are becoming available to everyone. For instance, RAG (Retrieval-Augmented Generation) can help create enterprise-grade applications. We’re also working on incorporating RAG into enterprise security models, and we think that’s going to be a significant trend in the coming years.
VMblog: Are you giving away any prizes at your booth or participating in any prize giveaways?
Manor: Yes, absolutely! At our booth, we’ll be raffling off a customized mechanical keyboard with a super cool retro look, created by Permit. It’s a limited-edition item, and we think everyone will love it. We’re also giving away limited-edition puzzles featuring Salt Lake City and the Kubernetes scene, something we created specifically for KubeCon. And, of course, we’ll have our usual super cool swag- stickers, t-shirts, and more. So, come by our booth to check it all out! Permit is known for having the best swag in the industry, and we’re just waiting for you to come grab some.
VMblog: Is your company sponsoring any type of party or get-together during the event that you’d like to notify attendees about?
Manor: Yes, we are hosting a private invitation-only event for thought leaders in the community. We’re holding it together with our venture partner, Scale Venture Partners, at the Leonardo Museum, one of the best museums in Salt Lake City. If you’re interested in attending, reach out to us, and we’ll see if we can get you an invitation.
VMblog: Do you have any advice for attendees of the show?
Manor: Yes, definitely! Decide in advance which segments or trends you want to follow, and make a list of what you want to see. This will help you stay organized and get the most out of your time at the event. Also, take notes as you go-there’s always a lot to learn!
