Dify is an open source produced by LangGenius and has received 143,000+ stars on GitHub. Provides visual workflow orchestration RAG knowledge base, multi-agent collaboration, model management and LLMOps monitoring, and supports access to 100+ mainstream models such as OpenAI, Claude, Gemini, Llama, DeepSeek, etc. Can be hosted in the cloud or fully private and self-deployed.

Dify’s open source AI workflow and Agent building platform

Dify’s core parameters and statistics

Dify is a platform that transforms "LLM application development" from code engineering to visual orchestration. It covers five capability lines of Agent building RAG knowledge base, multi-model management, workflow automation and LLMOps monitoring. It also provides two deployment paths: cloud hosting and fully self-hosting.

Projects	Public Information
Official positioning	Open source AI application development platform, covering Agent, RAG and multi-model orchestration
Development Team	LangGenius, Inc. (China)
Open source license	Apache 2.0 (some enterprise features are commercially licensed)
GitHub Stars	143,800+ (as of June 2026)
GitHub Forks	22,600+
Global Contributors	1,000+
Latest version	v1.14.2 (2026-05-19)
Deployment method	Cloud hosting (dify.ai) / Docker self-hosting / Kubernetes
Workflow node types	20+ (LLM, knowledge retrieval, conditional branching, code execution HTTP request, etc.)
Number of supported models	100+ mainstream LLM
RAG search method	Vector semantic retrieval + keyword full-text retrieval hybrid recall

Positioning Difference: The core difference of Dify is not to "provide a certain model", but to package multiple models into a visual engineering platform for RAG pipeline agent orchestration, monitoring and operation and maintenance. Compared with LangChain's code base form, Dify provides a GUI interface; compared with Coze's closed ecosystem, Dify allows completely private deployment. This combination of "visualization + self-hosting" has given it a unique adoption rate in the domestic enterprise market and overseas scenarios.

Community Density: 143K+ Stars correspond to 22K+ Forks, and the Fork/Star ratio is about 15.7%, indicating that the project not only has attention, but also has actual secondary development and contribution behaviors. There are more than 1,000 contributors around the world covering many aspects such as document translation, connector development and bug fixing. Community activity ranks first among similar open source AI projects.

Dify’s users and market recognition

The market's recognition of Dify is reflected in three levels: open source indicators, enterprise adoption and industry benchmarking, and the three levels verify each other.

Open Source Community Popularity: GitHub 143K+ Star is second only to LangChain among AI application construction projects, but the growth curve is steeper—from open source in March 2023 to breaking through 100K Star in early 2025, the growth rate is at the forefront among similar projects. 22K+ Forks shows that there are a large number of teams doing customized deployment or secondary development based on Dify.

Enterprise adoption breadth: Public information shows that Dify’s enterprise users have covered multiple vertical industries such as finance, medical care, retail, education, and manufacturing. Typical implementation forms include internal knowledge base question and answer robots, intelligent customer service, contract review assistance, and marketing content production lines. Although the official number of enterprise customers has not been disclosed (subject to the official real-time page), judging from community discussions and issue feedback, the adoption rate in financial compliance scenarios and overseas SaaS companies is relatively high.

Competitive product benchmarking: In terms of cross-positioning of "self-hosting + visual workflow + multi-model access", Dify currently has no direct competitors. n8n favors general automation and lacks RAG and model management depth; Flowise is lighter but has weaker enterprise-level capabilities (permissions, monitoring, high availability) than Dify; Coze emphasizes ease of use but cannot be deployed privately. Dify achieves high user recognition at the intersection of these four dimensions.

Dify’s cost advantage

Cost advantage: Cloud-ready and self-hosting lower the threshold for LLM application implementation

Dify's cost advantage comes from three levels: price system, deployment flexibility, and hidden cost control, which need to be evaluated separately.

C-side and individual developers: Cloud free version provides 200 message quota per day, suitable for prototype verification and light use. For individual developers, the self-hosted Community Edition is the more common option - with zero subscription fees and only the cost of a cloud server (minimum 2C4G instance to run lightweight workflows).

API and developer calls: Dify itself does not charge model calling fees, but as an orchestration layer it will count the message volume. Charges are based on the number of messages rather than the number of Tokens: Cloud Professional Edition is $59/month (workspace) with no message limit, and Team Edition starts at $159/month. Compared with the actual model API fee, Dify's orchestration layer cost is usually 5%-15% of the model call fee, which is a negligible level.

Enterprise Privatized Deployment: The community version is completely free, but you need to bear the costs of infrastructure (servers, storage, network), operation and maintenance manpower (upgrades, monitoring, backup) and customized development. For industries such as finance and medical care that have strict data sovereignty requirements, the total cost of ownership (TCO) of privatized deployment is usually lower than commercial SaaS products with equivalent functions, but the team is required to have Docker/Kubernetes operation and maintenance capabilities.

Price comparison with competing products:

Dimension	Dify Community Edition	Dify Cloud Professional Edition	Coze Business Edition	n8n Self-hosted
Subscription fee	$0	$59/month/workspace	Starting at $89/month	$0 (open source)
Infrastructure	Bring Your Own Server	Included in Subscription	Included in Subscription	Bring Your Own Server
Message/execution volume cap	None	No cap	Monthly limit	None
Data Sovereignty	Fully in Control	Hosted on Dify Cloud	Platform Closed	Fully in Control

Price data is based on the official real-time page of each product, and the table is extracted from public information.

Dify’s main functions

Dify's functional design revolves around "enabling non-technical teams to build AI applications and enabling technical teams to deeply customize". The core capabilities are divided into the following six categories:

• Visual workflow orchestration: 20+ node types covering LLM calls, knowledge retrieval, conditional branches, code execution HTTP requests, variable aggregation, etc. Each node can independently configure the model, parameters and exception handling, and publish it as an API or chat application with one click after the orchestration is completed. Acceptance concerns: Whether the node execution sequence visualization in complex branch scenarios is clear, and whether there are logs for traceable abnormal links.

• RAG Knowledge Base: Supports uploading PDF, Word, web pages, structured data and other formats, and automatically completes document parsing, text slicing, and vectorized indexing. The retrieval layer adopts a hybrid strategy of semantic vector retrieval (Dense) and keyword full-text retrieval (Sparse), which has a higher recall rate than pure vector retrieval in long documents and dense professional terminology scenarios. Acceptance concerns: whether the slicing strategy can be customized, whether the hybrid search weight is adjustable, and whether cross-database retrieval is supported between multiple knowledge bases.

• Multi-Agent collaboration: Supports the creation of multiple Agents in the same workflow and assigns different roles (such as researcher Agent, writing Agent, review Agent). Agents can transfer intermediate results and complete tasks collaboratively. This is more suitable than the single-Agent mode for production-level scenarios that require multi-step reasoning or division of labor. Acceptance concerns: whether the context transfer mechanism between agents is transparent and whether the task allocation strategy can be intervened programmatically.

• Unified management of 100+ models: Dify provides a unified model supplier access layer, supporting mainstream models such as OpenAI, Claude, Gemini, Llama, DeepSeek, Qwen, and Mistral. Each workflow node can independently select models and parameters to implement the hierarchical strategy of "use small models to save money for simple tasks, and use flagship models to maintain quality for complex reasoning."

• LLMOps monitoring and cost tracking: Built-in conversation log token usage statistics, response delay tracking and cost estimation panel. The team can continuously optimize prompt word design, model selection and knowledge base configuration based on this, which is an indispensable operation and maintenance component of the production environment.

• API publishing and embedded integration: REST API documents and calling credentials are automatically generated after each workflow or Agent application is published, and can be integrated in any external system. This capability makes Dify not an isolated application platform, but an orchestration layer that can be embedded into existing business systems.

• Plugins and Tool Extensions: Tool nodes can call external APIs and services (such as search engines, database connectors, internal enterprise systems) to expand the capabilities of the workflow. The current plug-in ecosystem is mainly community-driven, and the official plug-in market is under construction.

Dify’s model and version evolution

Dify's version iterations focus on two main lines: the construction of basic capabilities of the workflow engine, and the deep integration of Agent and RAG. It has now entered the v1.14.x stage, and the focus is on upgrading the Agent architecture.

Early exploration (v0.1 — v0.5)

• v0.1 (2023-03): Open source for the first time, providing basic LLM chat application templates and model access capabilities, and its form is close to the sample project of LLM applications.
• v0.3 (2023-07): Introduce the concept of RAG knowledge base, support document upload and vector retrieval, and shift from chat template to knowledge question and answer platform.
• v0.5 (2023-10): Knowledge base capabilities are enhanced, supporting multiple document formats and retrieval strategy optimization.

Workflow transformation (v0.6 — v0.9)

• v0.6 (2023-11): Milestone version, officially launched the visual workflow orchestration engine, supports drag-and-drop node orchestration, marking Dify's shift from "chat application template" to "AI workflow platform".
• v0.8 (2024-06): Introducing multi-Agent collaboration mode, extending workflow node types to 15+, supporting conditional branches and code execution nodes.
• v0.9 (2024-10): LLMOps monitoring panel is online, supports conversation log token usage and cost tracking, and completes production operation and maintenance capabilities.

Production ready (v1.0 — v1.13)

• v1.0 (2025-01-01): Milestone version, introducing enterprise-level permission management (RBAC), comprehensive LLMOps monitoring and a more complete API release process, marking Dify's entry into the production-ready stage.
• v1.5 (2025-06): Workflow node types are expanded to 20+, common nodes such as HTTP requests, variable aggregation, template conversion, etc. are added, and the community plug-in mechanism is initially opened.
• v1.10 (2025-12): The knowledge base supports structured data import, the hybrid search strategy is officially launched, and the search performance is greatly improved.

Agent Deepening (v1.14.x)

• v1.14.0 (2026-04-29): Main version feature update, Agent underlying architecture begins to be reconstructed, laying the foundation for subsequent advanced Agent capabilities (multi-Agent collaboration, dynamic tool selection).
• v1.14.1 (2026-05-12): Security hardening and workflow stability improvements.
• v1.14.2 (2026-05-19): Agent architecture continues to be improved, self-hosted deployment is optimized, and bugs are fixed.

Dify’s technical advantages

Dify's technical advantage does not lie in the leadership of a single point of algorithm, but in "architectural unity" and "engineering depth" - it integrates dispersed LLM development into a manageable product link.

Engineering depth of the visual orchestration engine: Dify's workflow engine is not a simple DAG drag and drop tool, but has a complete built-in execution context transfer, variable scope management, exception handling and retry mechanism. Each node independently maintains the input and output schema, and the data flow between nodes is automatically type checked and format converted by the engine to avoid handwritten glue code. This design allows the workflow to maintain consistent behavior between the visual interface and API calls - after the same workflow passes the test on the canvas, it can be published as an API and run directly in the production environment without additional adaptation.

Hybrid RAG retrieval architecture: Single vector retrieval is prone to false recalls due to semantic shifts in long documents and term-intensive scenarios. Dify uses Dense + Sparse dual-channel retrieval: the vector channel is responsible for semantic matching, the full-text retrieval channel is responsible for accurate keyword matching, and finally the results are fused through the Rerank layer. This architecture is significantly better than pure vector solutions for scenarios that require high accuracy such as technical documents, contract terms, and product specifications.

Business value of the model abstraction layer: Dify’s model supplier layer implements unified API format conversion and error handling. When a model service is unavailable or times out, the workflow can automatically switch to an alternate model at runtime without modifying the business logic. This is a practical design to reduce the risk of single points of failure for production systems that rely on multiple model vendors.

Architecture investment for private deployment: The self-hosted version of Dify supports two deployment modes: Docker Compose and Kubernetes, and provides a complete Helm Chart. The contextual variable management, persistent storage configuration, log collection and health checks required for production-level deployment are all covered by official documents, rather than simply "docker compose up".

Agent tool open list (Dify Workflow Node Type)

Dify's workflow nodes are essentially "tools" exposed to the LLM orchestration layer. In actual operation, LLM (or workflow engine) completes an interaction through these nodes:

Node type	Behavior description	Corresponding LLM Tool semantics
LLM	Call the specified model to generate a reply	llm_generate
Knowledge retrieval	Retrieve relevant document fragments from the knowledge base	retrieve_from_knowledge_base
Code execution	Run Python/JS code snippets	execute_code
HTTP request	Calling external REST API	http_request
Conditional branch (IF/ELSE)	Routing to different branches based on variable values	conditional_branch
Variable aggregation	Combine the output of multiple upstream nodes	aggregate_variables
Template transformation	Fill a text template with variable values	transform_template
Iterate	Execute a sub-workflow item by item on list data	iterate_items
Parameter extraction	Extract structured data from text	extract_parameters
Classifier	Route input to different branches based on LLM judgments	classifier
Agent node	Invoke sub-Agent to complete the task	invoke_agent

Architecture link

User input/API request
       ↓
[Dify Workflow Engine] ←── Model supplier abstraction layer (OpenAI/Claude/DeepSeek...)
       ↓
   ┌── LLM Node ──→ Model API
   ├── Knowledge retrieval node ──→ Vector database/full-text index
   ├── Code execution node ──→ Sandbox running context
   ├── HTTP request node ──→ External API / enterprise internal system
   └── Agent node ──→ Sub-Agent workflow
       ↓
  Final output/API response

The control flow is handled by the Workflow Engine: DAG execution sequence, conditional routing, and iteration are all uniformly scheduled by the engine; the data flow is passed between nodes through variable context. IO-intensive nodes such as model calling and knowledge retrieval are executed asynchronously. The engine collects the results through callbacks and then continues with subsequent nodes.

Engineering Pitfall Guide

Based on community feedback and engineering practices, you need to pay attention to the following three types of common issues when building production-level workflows on Dify:

1. Workflow endless loops and token surge: Iterative nodes and Agent recursive calls may produce infinite loops, causing Token consumption to far exceed expectations. Solution: Set the upper limit of max_iterations for all iteration nodes (10-20 is recommended); configure the maximum number of calling steps (max_steps) for the Agent node; add a conditional branch before the key node for termination judgment. Use the Token usage alarm function of the LLMOps monitoring panel to set the daily consumption threshold.

2. RAG context overload and reduced retrieval quality: When the number of knowledge base documents increases (>1000) and the document lengths vary (from a few KB to dozens of MB), the default slicing strategy may cause key information to be truncated or submerged in irrelevant fragments. Solution: Customize the slicing strategy according to the document type (technical documents use small slices 256 tokens + overlap 32 tokens; long articles use large slices 512 tokens + overlap 64 tokens); enable hybrid retrieval and adjust Dense/Sparse weights; build an independent dedicated knowledge base for high-frequency queries to reduce cross-database retrieval noise.

3. Security and Permission Governance after API Release: After the workflow is released as an API, if there is a lack of access control and rate limits, it may be abused or mistakenly called, leading to out-of-control costs. Solution: Generate an API Key separately for each API application and set up an IP whitelist; configure rate limits at the API gateway layer (it is recommended to limit the rate based on user levels); set up manual confirmation points (Human-in-the-loop) for operation nodes involving writing or deletion to prevent automated processes from performing irreversible operations.

Get started quickly in 3 minutes (cloud)

No installation required, complete your first AI workflow in as fast as 3 steps:

1. Visit https://cloud.dify.ai to register an account and create a new workspace.
2. Enter the "Model Supplier" page and configure at least one LLM API Key (such as OpenAI, DeepSeek).
3. Create a "chat" application → drag the three nodes "Input → LLM → Output" on the canvas → save and publish.

After publishing, you will get an AI application that can talk in the browser, and the corresponding REST API endpoint.

If you need self-hosted deployment, please refer to the official documentation:

# Docker self-hosting (Docker and Docker Compose must be installed)
cd /path/to/deploy
docker compose up -d
# Visit http://localhost:8080 to enter the management interface

For more detailed deployment configuration (contextual variables, persistent storage Kubernetes Helm Chart), please refer to the official GitHub repository README.

How to use Dify

Dify provides four usage portals, covering the entire path from personal verification to large-scale enterprise deployment:

How to use	Suitable for the crowd	Features	Cost
Cloud (dify.ai)	All users	No installation required, ready to use after registration, suitable for quick verification	Free version 200 messages per day / Professional version starting from $59/month
Docker self-hosting	Team with operation and maintenance capabilities	Completely self-controlled data, suitable for production deployment	Infrastructure cost (server + storage)
Kubernetes deployment	Enterprise IT team	Official Helm Chart, high-availability cluster deployment	Infrastructure + operation and maintenance manpower
API integration	Developer	Automatically generate REST API after workflow is published	According to Dify package + model API call fee

Typical usage link (quick start in the cloud):

1. Visit https://cloud.dify.ai to register an account and create a new workspace.
2. Configure the API Key of the required LLM (at least one) on the "Model Supplier" page.
3. Create an application: select "Chat", "Workflow" or "Agent" template.
4. Drag nodes on the canvas to complete the arrangement (for example: input → knowledge retrieval → LLM generation → output).
5. Save and publish to get the built-in chat interface and REST API endpoint.

Self-Hosted Quick Start:

git clone https://github.com/langgenius/dify.git
cddify/docker
cp .env.example .env # Edit contextual variables (database, storage, keys, etc.)
docker compose up -d
# Visit http://localhost:8080

For production environments, it is recommended to use Kubernetes Helm Chart and configure persistent storage, log collection, and monitoring alarms. The specific steps are subject to the official deployment documents.

Dify’s Product Pricing

Dify adopts a dual-track pricing model of "open source community version free + cloud SaaS tiered subscription", covering the entire path from personal verification to large-scale enterprise use.

Open Source Community Edition (Self-Hosted): Completely free, Apache 2.0 license (some enterprise features are commercially licensed). The code is completely open and can be modified and re-developed by yourself. The cost is mainly in infrastructure (servers, storage, network) and operation and maintenance manpower. The minimum recommended configuration is a cloud server with 2-core CPU and 4GB memory. The monthly infrastructure cost is about ¥50-200, depending on the cloud vendor.

Cloud Free ($0): 200 messages per day, up to 5 apps and 1 knowledge base (500 document limit). Suitable for personal learning and prototype verification. Exceeding the limit requires upgrading to a paid plan.

Cloud Pro ($59/month/workspace): No message limit, 50 apps, more knowledge base and storage space. Suitable for small teams to put 1-2 scenarios into production.

Cloud Team Edition (starting at $159/month): Multi-member collaboration, advanced permission management (RBAC), priority technical support. Suitable for medium-sized teams to use in multiple business lines in parallel.

Enterprise (Custom Offer): Includes SSO integration, audit logs, private deployment support, dedicated SLA and custom development. Suitable for large enterprises such as finance and medical care that have strict requirements for compliance and customization.

All prices are subject to the latest official pricing page. The actual cost of cloud services is also subject to the model API call fee. This part is paid directly by the user to the model supplier, and Dify does not take a commission from it.

Dify application scenarios

Dify’s implementation scenarios focus on internal enterprise scenarios that “require multi-step LLM orchestration + data sovereignty control”. The following are four types of proven high-value scenarios:

• Enterprise knowledge base Q&A: Upload the company's internal documents (product manuals, technical specifications, compliance documents) to the Dify knowledge base to build an internal Q&A robot. Employees ask questions in natural language, and LLM generates responses based on document snippets retrieved in real time. Compared with traditional document search, the key to improving answer accuracy lies in a hybrid retrieval strategy—technical terms are accurately hit by full-text retrieval, and semantically similar concepts are covered by vector retrieval. Key points to check: whether the slicing strategy matches the document structure and whether the index is automatically refreshed after the knowledge base is updated.

• Intelligent customer service and after-sales automation: Configure multi-step workflow: user question input → intent classifier → knowledge base retrieval → answer generation → emotional judgment → manual transfer decision. The benefits of this type of scenario are not only the replacement of manpower, but also the reduction of response time from hours to seconds, and the improvement in the consistency of customer service answers. Key points of verification: The accuracy of the classifier must reach more than 90% before it is suitable for online use; manual confirmation nodes must be retained for high-sensitivity scenarios such as refunds and complaints.

• Marketing content production line: Design an automated workflow of "keyword input → Internet search for competitive product information → LLM generation draft → secondary polishing → format output". Marketing teams can compress a single piece of content production time from 2-3 hours to 15-30 minutes. Key points of verification: Whether the generated draft conforms to the brand tone and whether manual review is required at key nodes.

• Automatic generation of operational analysis and reports: Access data sources (CSV, database, internal API), complete data cleaning and analysis through code execution nodes, and then generate analysis reports by LLM nodes. Suitable for daily/weekly reports, e-commerce operation analysis, market research and other scenarios. Key points to verify: The update frequency of the data source and the numerical accuracy of the access stability report generated by LLM (need to be cross-checked with the original data).

Applicable groups of Dify

Dify’s polymorphic strategy serves four types of roles, each with different entry paths and concerns:

• Developers & Engineering: Embed Dify workflows into existing systems via APIs and SDKs to avoid building an LLM orchestration layer from scratch. Concerns include API stability, version compatibility, and custom node development capabilities. Suitable for organizations with existing technical teams who want to quickly integrate AI capabilities into existing products.

• Enterprise Technology Manager: Privatized deployment capabilities and enterprise-level permission management (RBAC, SSO, audit logs) meet data compliance and security requirements. Focus includes high-availability solutions for the deployment architecture, data backup and recovery strategies, and integration costs with existing IT governance systems.

• Non-technical business personnel (operations/products/markets): Visual workflow orchestration does not require programming foundation, and business personnel can directly participate in AI application construction. However, it should be noted that complex business logic (multi-condition routing, dynamic parameter transfer) still requires the assistance of the technical team, and the visual interface cannot cover all programming flexibility.

• AI Entrepreneurship Teams and Independent Developers: Open source is free and reduces startup costs, and MVP can be built within a few hours. It is recommended to use the Cloud free version to verify the product direction first, and then evaluate whether to migrate to self-hosting to control costs after the number of users increases.

• Not suitable for scenarios: For scenarios with extremely high response latency requirements (millisecond-level real-time reasoning), Dify's orchestration layer will introduce additional delays, which is more suitable for interaction scenarios ranging from hundreds of milliseconds to seconds; for scenarios that require in-depth customization of LLM training or fine-tuning, Dify is an application layer rather than a training platform; for extremely large-scale scenarios (average daily millions of API calls), the self-hosted version needs to optimize its own deployment architecture, and Dify officially does not provide managed expansion services.

Summary and outlook of Dify

With its dual-engine positioning of "visual orchestration + open source self-hosting", Dify has successfully entered the market gap of enterprise LLM application development. 143K+ GitHub Stars and an ongoing active community validate the market value of its product direction—it’s not the fastest tool for building AI applications, but it’s the most pragmatic choice for organizations that require data sovereignty and governance.

Current limitations: Complex custom logic (advanced routing strategies, dynamic tool selection, multi-round Agent memory management) still requires certain programming capabilities, and the visual interface cannot cover 100% flexibility; large-scale production deployment (average daily millions of calls) requires the team to optimize the database, cache and load balancing by itself, and the official does not provide managed elastic expansion; domestic users may have network delays when accessing the Dify cloud-hosted version. Domestic users are recommended to give priority to self-hosting or deployment on overseas nodes.

Follow-up observation points: Agent architecture upgrade is the core direction of v1.14.x, and it is expected that more mature dynamic tool selection and Multi-Agent orchestration capabilities will be launched in subsequent versions; after the plug-in market shifts from community-driven to official governance, the ecological quality will directly affect the scalability of the platform; the progress of supporting the MCP protocol will determine whether Dify can integrate with a wider range of Agents Ecological interconnection and interoperability; the completeness of the enterprise version's functions (especially the depth of audit logs, custom role permissions, and data retention policies) are key decision-making factors for large-scale purchases.

Procurement implementation suggestions: It is recommended to use the Cloud free version to conduct a small-scale pilot in 1-2 high-value scenarios (such as internal knowledge base Q&A, customer service assistance) to verify the construction efficiency, answer quality and manual intervention rate reduction; after the pilot is passed, then evaluate whether to continue using the Cloud professional version or switch to self-hosting; before purchasing, enterprises need to focus on confirming: the commercial authorization terms of the self-hosted version, the actual coverage of the enterprise version's SSO and audit logs, and the official SLA's response time to production-bound failures.

Related tools: CrewAI, langchain

Version Info

• Dify v1.14.2 ：Security hardening and bug fixes, Agent underlying architecture improvements (to pave the way for subsequent advanced Agent capabilities), workflow reliability improvements, and self-hosted deployment optimization. （2026-05-19）
• Dify v1.14.1 ：Security hardening, workflow stability improvements, and self-hosted deployment cleanup. （2026-05-12）
• Dify v1.14.0 ：The main version function is updated. The specific content is subject to the official changelog. （2026-04-29）
• Dify v1.13.3 ：Workflow fixes and performance optimizations. （2026-03-27）
• Dify v1.0 official version ：The milestone release marks Dify’s entry into the production-ready stage, introducing comprehensive LLMOps monitoring and enterprise-level permission management. （2025-01-01）