Comparison

Permisyn vs. everyone else, by name.

14 named vendors, their real current pricing, and 31 capabilities compared one row at a time. Every price links to that vendor's own page, and the rows where Permisyn is the wrong tool are left in — you can find them by looking for our crosses.

Last verified August 2026. Vendors change pricing and features often — this is a snapshot, not a live feed.

The one distinction that matters more than any single feature row

The rows below split into four kinds of product. Gateways (Portkey, Kong, Cloudflare, LiteLLM, TrueFoundry, Helicone) are proxies like Permisyn, but built for routing, caching and cost observability first. Content guardrails — Pangea, Lakera, Aporia — read prompts and responses for threats and sensitive data, which Permisyn deliberately does not do. Authorization systems (Permit.io, Auth0, Arcade) govern identities, resources and tool execution. Governance platforms (Arthur, Credal) report on AI programmes. Permisyn is the model-boundary control plane: identity and passport authorization, spend and fleet controls, and an Ed25519-signed decision receipt for every governed call. It sits alongside content scanning rather than pretending to replace it.

This market consolidated in 2025–26: Portkey is now part of Palo Alto Networks, Pangea of CrowdStrike, Lakera of Check Point, Aporia of Coralogix. Where that happened, the row says so — it usually changes who you buy from and what the roadmap answers to.

The field

Vendor	Category	Entry price	Deployment	Rows met in full
Permisyn	Pre-execution authorization	Free → from $19/mo (Starter)	Proxy — zero code change	28 of 31
Portkey now Palo Alto Networks	AI gateway	Free (10K logs) → $49/mo	Proxy	9 of 31
Kong AI Gateway	API/AI gateway	Free (OSS core) → Konnect contract	Proxy (self-hosted or Konnect)	8 of 31
Cloudflare AI Gateway	AI gateway	Free (bundled with Workers)	Proxy (edge, managed only)	7 of 31
LiteLLM	AI gateway (OSS)	Free (OSS) → Enterprise from ~$250/mo	Proxy (self-hosted)	8 of 31
TrueFoundry	AI gateway	Free (50K req) → $499/mo (Pro)	Proxy (K8s, VPC or SaaS)	9 of 31
Helicone	Observability + gateway	Free (10K req/mo) → $79/mo (Pro)	Proxy or SDK	5 of 31
Pangea AI Guard now CrowdStrike	AI content security	Free account; service pricing not public	API / SDK / gateway plugin	4 of 31
Lakera Guard now Check Point	Guardrails	Free (10K req/mo) → Enterprise custom	API call you integrate	2 of 31
Aporia now Coralogix	Guardrails	Free tier → Coralogix units ($1.50/unit)	API call you integrate	3 of 31
Permit.io	Fine-grained authorization	Free → from $5/mo (Startup)	PDP / MCP gateway	3 of 31
Auth0 for AI Agents now Okta	Identity & agent access	Free (25K MAU) → $35/mo + 50% AI add-on	OAuth / API / SDK	3 of 31
Arcade.dev	Agent tool runtime	Free → $25/mo + usage (Growth)	MCP runtime / hosted tools	3 of 31
Arthur AI	Enterprise AI governance	Free → $60/mo (Premium)	SDK / OTEL discovery / API	4 of 31
Credal	Enterprise AI governance	Custom only (no public pricing)	Platform integration	1 of 31

“Rows met in full” counts only the 31 rows below, which are the ones Permisyn was built around — a guardrails vendor scoring low here is doing a different job well, not doing this job badly. 3 of those rows are ones we do not meet.

Capability by capability— 31 rows, every vendor scored on each

Capability	Permisyn	Portkey Palo Alto Networks	Kong AI Gateway	Cloudflare AI Gateway	LiteLLM	TrueFoundry	Helicone	Pangea AI Guard CrowdStrike	Lakera Guard Check Point	Aporia Coralogix	Permit.io	Auth0 for AI Agents Okta	Arcade.dev	Arthur AI	Credal
How it sits in your stackBefore any feature row: where the thing runs, and whether you can buy it without a sales call.
Drop-in proxy, no application code change Change the base URL and existing SDK calls are governed. No wrapper library, no per-call instrumentation. See it →
Public price, self-serve signup A published number you can read and a card you can enter, without a demo call first. See it →
Built-in sandbox, on the same account A test key that writes to a separate partition — its own agents, receipts and monthly quota — so a load test cannot spend, halt or pollute production. Partial means you can approximate it by standing up a second workspace or project and keeping the two apart yourself. See it →
Model routing, caching and failover Load-balancing across providers, semantic caching, automatic fallback to a cheaper or healthier model.
Deciding before the model runsEverything here happens in the request path, before a token is spent — not in a dashboard afterwards.
Signed, versioned policy per agent One passport per agent naming its allowed models, providers, budget and regions, versioned so you can prove what the rule was on the day of an incident. See it →
Tool-call authorization before execution The specific tool an agent asked to call is checked against policy and can be refused before it runs — an LLM's own declared tool calls, and (via a small local gateway process) MCP server tool calls too. A request offering several tools need not be all-or-nothing: the disallowed ones can be stripped before the provider sees them, so the call proceeds without the capability rather than failing outright. See it →
Spend cap enforced before the provider call A budget that blocks the request itself, rather than an alert that arrives with the invoice. See it →
Region/residency enforced per agent This agent may only reach EU endpoints — enforced per call, not just chosen once at deployment time. See it →
Halt an org, a team, or one accountable user Three granularities of stop. Freezing one person's agents without hunting down every key they touched. See it →
Human approval gate for elevated access A sensitive or widened permission waits on a named human, and expires on its own afterwards. See it →
Agent-to-agent delegation, scoped and budgeted Agent A hands agent B a narrower grant with its own ceiling and expiry, and the grant is itself governed. See it →
Prompt-injection and content classification Reading the prompt or the response to judge whether it is an attack, a jailbreak, or unsafe content.
Evidence someone else can checkThe difference between a log you are asked to believe and a receipt an auditor can verify without us.
Ed25519-signed decision receipt per call Every governed call — allowed or refused — produces a signed record of the decision, the rule, and the accountable identity. See it →
Append-only log with inclusion proofs A Merkle-structured log where a single altered or removed entry breaks the proof. See it →
Consistency proof between two log heads Inclusion proves an entry is in TODAY'S tree; it cannot see a log rebuilt overnight and re-published, which passes every inclusion check. A consistency proof shows the tree you recorded earlier is still a prefix of the current one. Permisyn pins a head in your own browser and serves the proof against it, ships the check in both verifier packages, and publishes a monitor cron that exits non-zero only on a genuine contradiction. See it →
Signed proof carried on the response itself A compact signed token on the response, so the code holding the answer can check the decision in its own process against a published key. Without it, a run id is a pointer: you make a second call to the vendor and then take their word for the reply. Opt-in per call, and it costs about 0.1ms. See it →
Anchored to an external public chain Periodic roots published outside the vendor's own infrastructure, so backdating requires rewriting something we do not control. See it →
Verifiable offline, without the vendor An export that carries the public keys and a verifier that runs with us switched off — including after a key rotation. Published as installable packages rather than a snippet to copy: permisyn-verify on PyPI and @permisyn/verify on npm, both of which check receipts, credentials and the log's own proofs without importing anything of ours. See it →
Hash-linked multi-agent chain of custody Each hop's input hash must equal the previous hop's output hash, so a missing or edited step in an agent-to-agent chain is provable — not merely a trace drawn next to it. Tool results are inside the chain, not beside it: an MCP tool's output is hashed into its own signed receipt, and the LLM call that consumes it names that hash, so 'the model was fed something other than what the tool returned' is a claim the evidence can refuse. See it →
Public verification page and trust badge An outsider with no login can check a receipt and an embeddable badge signed by the same key. See it →
Auditor access without an account A scoped, expiring, revocable link an external auditor or regulator opens directly — no shared login, no screenshots. See it →
Compliance attestation generated from the log EU AI Act, SOC 2 and HIPAA statements built from the signed record and signed themselves, not a PDF written once by hand. See it →
AI Bill of Materials A signed inventory of every model and provider actually called, with real counts and first/last-seen — derived from traffic, not self-reported. See it →
Public red-team sandbox running production code Anyone can try to break the live enforcement and signature paths without signing up. See it →
Living with it day to dayThe parts you touch after the first week: telemetry, secrets, spend, and drift.
OpenTelemetry export to your own stack Spans in your Datadog, Grafana or Honeycomb — with the governance decision attached, not just latency and tokens. See it →
PII and secret redaction in the request path Sensitive strings removed or masked before the prompt reaches the provider. Permisyn redacts the secrets you REGISTER, matched exactly by fingerprint — it deliberately does not pattern-guess at PII, which is why this row is a partial and not a tick. See it →
Secret enforcement without holding the secret Your credentials are enforced as salted fingerprints. We can block a leak of a secret we were never given and could not reconstruct. See it →
Wasted spend accounted for, not just total spend Money burned on refused, retried and discarded calls, priced and attributed per agent and team. See it →
Per-agent behavioural drift detection An agent measured against its own established baseline, with the verdict carried on the signed receipt. See it →
Provider keys held encrypted, never in the client Upstream credentials stay server-side and are injected at call time, so an agent never carries a provider key. See it →
Own overhead reported on every response A header separating the provider's latency from what governance cost, so the tax is measurable rather than asserted. See it →

ships it as described adjacent capability, not equivalent not part of the product

A dash is a real capability doing a nearby job: Pangea's Secure Audit Log genuinely publishes verification artifacts, but that is not a pre-execution authorization receipt; revoking a virtual key genuinely stops traffic, but it is not a per-user halt across a fleet. Click any vendor name to check the current product yourself.

By category

AI gateways

Portkey (Palo Alto Networks) · Kong AI Gateway · Cloudflare AI Gateway · LiteLLM · TrueFoundry · Helicone

Built to route, cache and log traffic across providers, and genuinely good at it — several now enforce hard budgets and gate MCP tools too, which is why those rows are ticks. What none of them produce is a signed, independently verifiable decision for each call, or a per-agent policy you can prove was in force on a given date.

Guardrails & runtime security

Lakera Guard (Check Point) · Aporia (Coralogix)

Classify whether a prompt or response looks unsafe — prompt injection, PII, content policy. Permisyn scores a cross on that row on purpose: it decides whether an identified call is allowed to happen, and leaves reading the content to tools built for it.

Content security & tamper-evident logging

Pangea AI Guard (CrowdStrike)

The closest thing to our evidence story, and the only vendor here that shares the consistency-proof row with us: its Secure Audit Log is a real Merkle log with membership and consistency proofs and a published root. The difference is what gets logged — an inspection verdict on content, rather than an authorization decision about an identified agent's call, its passport, budget and fleet state.

Agent identity & tool authorization

Permit.io · Auth0 for AI Agents (Okta) · Arcade.dev

Strong adjacent products for resource permissions, OAuth identity, MCP access, token vaults and human consent — they earn ticks on tool authorization and approval gates. They govern what an agent may touch; Permisyn governs the model call itself, with spend, region and fleet controls and a receipt on each decision.

Enterprise AI governance

Arthur AI · Credal

Discovery, dashboards, evals and permission mirroring for enterprise AI programmes — real value for compliance reporting. They integrate via SDK, OTEL and platform hooks rather than sitting in front of every model call, and neither publishes a signed receipt an outsider can verify.

When not to buy Permisyn

If what you need is failover between providers, semantic caching and a cheaper routing bill, buy a gateway — we do not do those and are not planning to. If what you need is prompt-injection defence and content classification, buy a guardrails product; several of them run as a plugin in front of, or behind, a proxy like ours. Permisyn is worth paying for when someone will eventually ask who authorized this call, under which rule, and can you prove it — and a screenshot of a dashboard is not going to be an acceptable answer.

See the difference on your own traffic.

No sales call required — start free, point your existing client at Permisyn, and watch the first decision get signed.

Start free See Permisyn pricing