diff --git a/README.md b/README.md
index f1bdb6fea738ce..33ec62d271db5e 100644
--- a/README.md
+++ b/README.md
@@ -889,15 +889,15 @@ releases on a rotation basis as outlined in the
   * [bengl](https://github.com/bengl) -
     **Bryan English** <<bryan@bryanenglish.com>> (he/him)
 * [HeroDevs](https://www.herodevs.com/)
-  * [juanarbol](https://github.com/juanarbol) - OpenJSF handle: `juanarbol`
+  * [juanarbol](https://github.com/juanarbol) - OpenJS Slack handle: `juanarbol`
     **Juan José Arboleda** <<soyjuanarbol@gmail.com>> (he/him)
-  * [marco-ippolito](https://github.com/marco-ippolito) - OpenJSF handle: `Marco Ippolito`
+  * [marco-ippolito](https://github.com/marco-ippolito) - OpenJS Slack handle: `Marco Ippolito`
     **Marco Ippolito** <<marcoippolito54@gmail.com>> (he/him)
 * [NodeSource](https://nodesource.com/)
-  * [RafaelGSS](https://github.com/RafaelGSS) - OpenJSF handle: `RafaelGSS`
+  * [RafaelGSS](https://github.com/RafaelGSS) - OpenJS Slack handle: `RafaelGSS`
     **Rafael Gonzaga** <<rafael.nunu@hotmail.com>> (he/him)
 * [Platformatic](https://platformatic.dev/)
-  * [mcollina](https://github.com/mcollina) - OpenJSF handle: `mcollina`
+  * [mcollina](https://github.com/mcollina) - OpenJS Slack handle: `mcollina`
     **Matteo Collina** <<matteo.collina@gmail.com>> (he/him)
 * [Red Hat](https://redhat.com) / [IBM](https://ibm.com)
   * [BethGriggs](https://github.com/BethGriggs) -
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 4d8e806723866d..b21170e02b76a7 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -2174,6 +2174,16 @@ following permissions are restricted:
 * WASI - manageable through [`--allow-wasi`][] flag
 * Addons - manageable through [`--allow-addons`][] flag
 
+### `--permission-audit`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Enable audit only for the permission model. When enabled, permission checks
+are performed but access is not denied. Instead, a warning is emitted for
+each permission violation via diagnostics channel.
+
 ### `--preserve-symlinks`
 
 <!-- YAML
@@ -3660,6 +3670,7 @@ one is included in the list below.
 * `--openssl-legacy-provider`
 * `--openssl-shared-config`
 * `--pending-deprecation`
+* `--permission-audit`
 * `--permission`
 * `--preserve-symlinks-main`
 * `--preserve-symlinks`
diff --git a/doc/node.1 b/doc/node.1
index 8075225d5d1b3e..41cfd8844b3d1d 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -1115,6 +1115,11 @@ WASI - manageable through \fB--allow-wasi\fR flag
 Addons - manageable through \fB--allow-addons\fR flag
 .El
 .
+.It Fl -permission-audit
+Enable audit only for the permission model. When enabled, permission checks
+are performed but access is not denied. Instead, a warning is emitted for
+each permission violation via diagnostics channel.
+.
 .It Fl -preserve-symlinks
 Instructs the module loader to preserve symbolic links when resolving and
 caching modules.
@@ -1978,6 +1983,8 @@ one is included in the list below.
 .It
 \fB--permission\fR
 .It
+\fB--permission-audit\fR
+.It
 \fB--preserve-symlinks-main\fR
 .It
 \fB--preserve-symlinks\fR
diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index 3deb301e7f3cd2..bd17965b131208 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -31,6 +31,9 @@ const {
 
 const { triggerUncaughtException } = internalBinding('errors');
 
+const dc_binding = internalBinding('diagnostics_channel');
+const { subscribers: subscriberCounts } = dc_binding;
+
 const { WeakReference } = require('internal/util');
 
 // Can't delete when weakref count reaches 0 as it could increment again.
@@ -108,6 +111,7 @@ class ActiveChannel {
     this._subscribers = ArrayPrototypeSlice(this._subscribers);
     ArrayPrototypePush(this._subscribers, subscription);
     channels.incRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]++;
   }
 
   unsubscribe(subscription) {
@@ -120,6 +124,7 @@ class ActiveChannel {
     ArrayPrototypePushApply(this._subscribers, after);
 
     channels.decRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]--;
     maybeMarkInactive(this);
 
     return true;
@@ -127,7 +132,10 @@ class ActiveChannel {
 
   bindStore(store, transform) {
     const replacing = this._stores.has(store);
-    if (!replacing) channels.incRef(this.name);
+    if (!replacing) {
+      channels.incRef(this.name);
+      if (this._index !== undefined) subscriberCounts[this._index]++;
+    }
     this._stores.set(store, transform);
   }
 
@@ -139,6 +147,7 @@ class ActiveChannel {
     this._stores.delete(store);
 
     channels.decRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]--;
     maybeMarkInactive(this);
 
     return true;
@@ -183,6 +192,9 @@ class Channel {
     this._subscribers = undefined;
     this._stores = undefined;
     this.name = name;
+    if (typeof name === 'string') {
+      this._index = dc_binding.getOrCreateChannelIndex(name);
+    }
 
     channels.set(name, this);
   }
@@ -434,6 +446,8 @@ function tracingChannel(nameOrChannels) {
   return new TracingChannel(nameOrChannels);
 }
 
+dc_binding.linkNativeChannel((name) => channel(name));
+
 module.exports = {
   channel,
   hasSubscribers,
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index ebb44b935e1b58..b68b4e26d4a7c9 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -124,6 +124,8 @@ function prepareExecution(options) {
   // Process initial diagnostic reporting configuration, if present.
   initializeReport();
 
+  setupDiagnosticsChannel();
+
   // Load permission system API
   initializePermission();
 
@@ -622,8 +624,16 @@ function initializeClusterIPC() {
   }
 }
 
+function setupDiagnosticsChannel() {
+  // Re-link native channels after snapshot deserialization since
+  // JS references are cleared during serialization.
+  const dc = require('diagnostics_channel');
+  const dc_binding = internalBinding('diagnostics_channel');
+  dc_binding.linkNativeChannel((name) => dc.channel(name));
+}
+
 function initializePermission() {
-  const permission = getOptionValue('--permission');
+  const permission = getOptionValue('--permission') || getOptionValue('--permission-audit');
   if (permission) {
     process.binding = function binding(_module) {
       throw new ERR_ACCESS_DENIED('process.binding');
diff --git a/node.gyp b/node.gyp
index 47ec88c43d0bcd..d24707e88ffce0 100644
--- a/node.gyp
+++ b/node.gyp
@@ -133,6 +133,7 @@
       'src/node_main_instance.cc',
       'src/node_messaging.cc',
       'src/node_metadata.cc',
+      'src/node_diagnostics_channel.cc',
       'src/node_modules.cc',
       'src/node_options.cc',
       'src/node_os.cc',
@@ -270,6 +271,7 @@
       'src/node_messaging.h',
       'src/node_metadata.h',
       'src/node_mutex.h',
+      'src/node_diagnostics_channel.h',
       'src/node_modules.h',
       'src/node_object_wrap.h',
       'src/node_options.h',
diff --git a/src/base_object_types.h b/src/base_object_types.h
index 9cfe6a77f71708..cd1a06e41a3071 100644
--- a/src/base_object_types.h
+++ b/src/base_object_types.h
@@ -10,6 +10,7 @@ namespace node {
 // what the class passes to SET_BINDING_ID(), the second argument should match
 // the C++ class name.
 #define SERIALIZABLE_BINDING_TYPES(V)                                          \
+  V(diagnostics_channel_binding_data, diagnostics_channel::BindingData)        \
   V(encoding_binding_data, encoding_binding::BindingData)                      \
   V(fs_binding_data, fs::BindingData)                                          \
   V(mksnapshot_binding_data, mksnapshot::BindingData)                          \
diff --git a/src/env.cc b/src/env.cc
index b94cb9784b0791..04807ffae13437 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -918,8 +918,11 @@ Environment::Environment(IsolateData* isolate_data,
                                       tracing::CastTracedValue(traced_value));
   }
 
-  if (options_->permission) {
+  if (options_->permission || options_->permission_audit) {
     permission()->EnablePermissions();
+    if (options_->permission_audit) {
+      permission()->EnableWarningOnly();
+    }
     // The process shouldn't be able to neither
     // spawn/worker nor use addons or enable inspector
     // unless explicitly allowed by the user
diff --git a/src/node_binding.cc b/src/node_binding.cc
index 740706e917b7d2..b76ecc8cab47df 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -48,6 +48,7 @@
   V(constants)                                                                 \
   V(contextify)                                                                \
   V(credentials)                                                               \
+  V(diagnostics_channel)                                                       \
   V(encoding_binding)                                                          \
   V(errors)                                                                    \
   V(fs)                                                                        \
diff --git a/src/node_binding.h b/src/node_binding.h
index dbb4c137afc776..83f8cee7c9f7b0 100644
--- a/src/node_binding.h
+++ b/src/node_binding.h
@@ -49,6 +49,7 @@ static_assert(static_cast<int>(NM_F_LINKED) ==
   V(blob)                                                                      \
   V(builtins)                                                                  \
   V(contextify)                                                                \
+  V(diagnostics_channel)                                                       \
   V(encoding_binding)                                                          \
   V(fs)                                                                        \
   V(fs_dir)                                                                    \
diff --git a/src/node_diagnostics_channel.cc b/src/node_diagnostics_channel.cc
new file mode 100644
index 00000000000000..450a124c86959a
--- /dev/null
+++ b/src/node_diagnostics_channel.cc
@@ -0,0 +1,293 @@
+#include "node_diagnostics_channel.h"
+
+#include "base_object-inl.h"
+#include "env-inl.h"
+#include "node_external_reference.h"
+#include "util-inl.h"
+#include "v8.h"
+
+#include <cstdint>
+
+namespace node {
+namespace diagnostics_channel {
+
+using v8::Context;
+using v8::Function;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::HandleScope;
+using v8::Isolate;
+using v8::Local;
+using v8::Object;
+using v8::ObjectTemplate;
+using v8::SnapshotCreator;
+using v8::String;
+using v8::Value;
+
+BindingData::BindingData(Realm* realm,
+                         Local<Object> wrap,
+                         InternalFieldInfo* info)
+    : SnapshotableObject(realm, wrap, type_int),
+      subscribers_(
+          realm->isolate(), kMaxChannels, MAYBE_FIELD_PTR(info, subscribers)) {
+  if (info == nullptr) {
+    wrap->Set(realm->context(),
+              FIXED_ONE_BYTE_STRING(realm->isolate(), "subscribers"),
+              subscribers_.GetJSArray())
+        .Check();
+  } else {
+    subscribers_.Deserialize(realm->context());
+  }
+  subscribers_.MakeWeak();
+}
+
+void BindingData::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("subscribers", subscribers_);
+}
+
+uint32_t BindingData::GetOrCreateChannelIndex(const std::string& name) {
+  auto it = channel_indices_.find(name);
+  if (it != channel_indices_.end()) {
+    return it->second;
+  }
+  CHECK_LT(next_channel_index_, kMaxChannels);
+  uint32_t index = next_channel_index_++;
+  channel_indices_.emplace(name, index);
+  return index;
+}
+
+void BindingData::GetOrCreateChannelIndex(
+    const FunctionCallbackInfo<Value>& args) {
+  Realm* realm = Realm::GetCurrent(args);
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  CHECK_NOT_NULL(binding);
+
+  CHECK(args[0]->IsString());
+  Utf8Value name(realm->isolate(), args[0]);
+
+  uint32_t index = binding->GetOrCreateChannelIndex(*name);
+  args.GetReturnValue().Set(index);
+}
+
+void BindingData::LinkNativeChannel(const FunctionCallbackInfo<Value>& args) {
+  Realm* realm = Realm::GetCurrent(args);
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  CHECK_NOT_NULL(binding);
+
+  CHECK(args[0]->IsFunction());
+  Isolate* isolate = realm->isolate();
+  Local<Context> context = realm->context();
+  binding->link_callback_.Reset(isolate, args[0].As<Function>());
+
+  // Resolve channels created before the link callback was available.
+  for (auto& channel_ptr : binding->channels_) {
+    if (channel_ptr && !channel_ptr->IsLinked()) {
+      Local<String> name =
+          String::NewFromUtf8(isolate, channel_ptr->name_.c_str())
+              .ToLocalChecked();
+      Local<Value> argv[] = {name};
+      Local<Value> result;
+      if (binding->link_callback_.Get(isolate)
+              ->Call(context, v8::Undefined(isolate), 1, argv)
+              .ToLocal(&result) &&
+          result->IsObject()) {
+        channel_ptr->Link(isolate, result.As<Object>());
+      }
+    }
+  }
+}
+
+bool BindingData::PrepareForSerialization(Local<Context> context,
+                                          SnapshotCreator* creator) {
+  DCHECK_NULL(internal_field_info_);
+  internal_field_info_ = InternalFieldInfoBase::New<InternalFieldInfo>(type());
+  internal_field_info_->subscribers = subscribers_.Serialize(context, creator);
+  link_callback_.Reset();
+  channel_wrap_template_.Reset();
+  channels_.clear();
+  return true;
+}
+
+InternalFieldInfoBase* BindingData::Serialize(int index) {
+  DCHECK_IS_SNAPSHOT_SLOT(index);
+  InternalFieldInfo* info = internal_field_info_;
+  internal_field_info_ = nullptr;
+  return info;
+}
+
+void BindingData::Deserialize(Local<Context> context,
+                              Local<Object> holder,
+                              int index,
+                              InternalFieldInfoBase* info) {
+  DCHECK_IS_SNAPSHOT_SLOT(index);
+  HandleScope scope(Isolate::GetCurrent());
+  Realm* realm = Realm::GetCurrent(context);
+  BindingData* binding = realm->AddBindingData<BindingData>(
+      holder, static_cast<InternalFieldInfo*>(info));
+  CHECK_NOT_NULL(binding);
+}
+
+void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
+                                             Local<ObjectTemplate> target) {
+  Isolate* isolate = isolate_data->isolate();
+  SetMethod(
+      isolate, target, "getOrCreateChannelIndex", GetOrCreateChannelIndex);
+  SetMethod(isolate, target, "linkNativeChannel", LinkNativeChannel);
+}
+
+void BindingData::CreatePerContextProperties(Local<Object> target,
+                                             Local<Value> unused,
+                                             Local<Context> context,
+                                             void* priv) {
+  Realm* realm = Realm::GetCurrent(context);
+  BindingData* const binding = realm->AddBindingData<BindingData>(target);
+  if (binding == nullptr) return;
+}
+
+void BindingData::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(GetOrCreateChannelIndex);
+  registry->Register(LinkNativeChannel);
+}
+
+Channel::Channel(Environment* env,
+                 Local<Object> wrap,
+                 BindingData* binding_data,
+                 uint32_t index,
+                 std::string name)
+    : BaseObject(env, wrap),
+      binding_data_(binding_data),
+      index_(index),
+      name_(std::move(name)) {
+  MakeWeak();
+}
+
+void Channel::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("js_channel", js_channel_);
+  tracker->TrackField("publish_fn", publish_fn_);
+}
+
+void Channel::Link(Isolate* isolate, Local<Object> js_channel) {
+  js_channel_.Reset(isolate, js_channel);
+  // If the channel already has subscribers at link time (JS subscribed before
+  // C++ called Get()), cache publish eagerly so Publish() has no extra work.
+  if (HasSubscribers()) {
+    CachePublishFn(isolate, js_channel);
+  }
+}
+
+void Channel::Unlink() {
+  js_channel_.Reset();
+  publish_fn_.Reset();
+}
+
+Channel* Channel::Get(Environment* env, const char* name) {
+  Realm* realm = env->principal_realm();
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  if (binding == nullptr) {
+    return nullptr;
+  }
+  uint32_t index = binding->GetOrCreateChannelIndex(std::string(name));
+
+  if (index >= binding->channels_.size()) {
+    binding->channels_.resize(index + 1);
+  }
+
+  if (!binding->channels_[index]) {
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Local<Context> context = env->context();
+
+    // Lazily create the wrap template for Channel objects.
+    if (binding->channel_wrap_template_.IsEmpty()) {
+      Local<FunctionTemplate> tmpl =
+          BaseObject::MakeLazilyInitializedJSTemplate(env);
+      binding->channel_wrap_template_.Reset(isolate, tmpl);
+    }
+
+    Local<Object> wrap;
+    if (!binding->channel_wrap_template_.Get(isolate)
+             ->GetFunction(context)
+             .ToLocalChecked()
+             ->NewInstance(context)
+             .ToLocal(&wrap)) {
+      return nullptr;
+    }
+
+    binding->channels_[index] = MakeDetachedBaseObject<Channel>(
+        env, wrap, binding, index, std::string(name));
+  }
+
+  Channel* channel = binding->channels_[index].get();
+
+  // Late-bind: link to the JS channel when the callback is available.
+  if (!binding->link_callback_.IsEmpty() && !channel->IsLinked()) {
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Local<Context> context = env->context();
+    Local<String> js_name = String::NewFromUtf8(isolate, name).ToLocalChecked();
+    Local<Value> argv[] = {js_name};
+    Local<Value> result;
+    if (binding->link_callback_.Get(isolate)
+            ->Call(context, v8::Undefined(isolate), 1, argv)
+            .ToLocal(&result) &&
+        result->IsObject()) {
+      channel->Link(isolate, result.As<Object>());
+    }
+  }
+
+  return channel;
+}
+
+void Channel::CachePublishFn(Isolate* isolate, Local<Object> js_channel) {
+  Local<Value> publish_val;
+  Local<Context> context = isolate->GetCurrentContext();
+  if (js_channel->Get(context, FIXED_ONE_BYTE_STRING(isolate, "publish"))
+          .ToLocal(&publish_val) &&
+      publish_val->IsFunction()) {
+    publish_fn_.Reset(isolate, publish_val.As<Function>());
+  }
+}
+
+void Channel::Publish(Environment* env, Local<Value> message) {
+  if (!HasSubscribers()) return;
+
+  if (binding_data_ == nullptr) return;
+
+  if (js_channel_.IsEmpty()) return;
+
+  // Publishing is not possible during shutdown or GC.
+  DCHECK(env->can_call_into_js());
+  if (!env->can_call_into_js()) return;
+
+  Isolate* isolate = env->isolate();
+  HandleScope handle_scope(isolate);
+  Local<Context> context = env->context();
+  Context::Scope context_scope(context);
+
+  Local<Object> js_channel = js_channel_.Get(isolate);
+
+  // publish_fn_ is eagerly cached by Link() when the channel already has
+  // subscribers at link time. For channels linked before any JS subscriber
+  // existed, cache it here on the first publish — happens exactly once.
+  if (publish_fn_.IsEmpty()) {
+    CachePublishFn(isolate, js_channel);
+    if (publish_fn_.IsEmpty()) return;
+  }
+
+  Local<Value> argv[] = {message};
+  USE(publish_fn_.Get(isolate)->Call(context, js_channel, 1, argv));
+}
+
+}  // namespace diagnostics_channel
+}  // namespace node
+
+NODE_BINDING_CONTEXT_AWARE_INTERNAL(
+    diagnostics_channel,
+    node::diagnostics_channel::BindingData::CreatePerContextProperties)
+NODE_BINDING_PER_ISOLATE_INIT(
+    diagnostics_channel,
+    node::diagnostics_channel::BindingData::CreatePerIsolateProperties)
+NODE_BINDING_EXTERNAL_REFERENCE(
+    diagnostics_channel,
+    node::diagnostics_channel::BindingData::RegisterExternalReferences)
diff --git a/src/node_diagnostics_channel.h b/src/node_diagnostics_channel.h
new file mode 100644
index 00000000000000..1c1831a0f9e45f
--- /dev/null
+++ b/src/node_diagnostics_channel.h
@@ -0,0 +1,113 @@
+#ifndef SRC_NODE_DIAGNOSTICS_CHANNEL_H_
+#define SRC_NODE_DIAGNOSTICS_CHANNEL_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <cinttypes>
+#include <string>
+#include <unordered_map>
+#include <vector>
+#include "aliased_buffer.h"
+#include "base_object.h"
+#include "node_snapshotable.h"
+
+namespace node {
+class ExternalReferenceRegistry;
+
+namespace diagnostics_channel {
+
+class Channel;
+
+class BindingData : public SnapshotableObject {
+ public:
+  static constexpr size_t kMaxChannels = 1024;
+
+  struct InternalFieldInfo : public node::InternalFieldInfoBase {
+    AliasedBufferIndex subscribers;
+  };
+
+  BindingData(Realm* realm,
+              v8::Local<v8::Object> wrap,
+              InternalFieldInfo* info = nullptr);
+
+  SERIALIZABLE_OBJECT_METHODS()
+  SET_BINDING_ID(diagnostics_channel_binding_data)
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_SELF_SIZE(BindingData)
+  SET_MEMORY_INFO_NAME(BindingData)
+
+  AliasedUint32Array subscribers_;
+
+  uint32_t next_channel_index_ = 0;
+  std::unordered_map<std::string, uint32_t> channel_indices_;
+
+  uint32_t GetOrCreateChannelIndex(const std::string& name);
+
+  v8::Global<v8::Function> link_callback_;
+  v8::Global<v8::FunctionTemplate> channel_wrap_template_;
+  std::vector<BaseObjectPtr<Channel>> channels_;
+
+  static void GetOrCreateChannelIndex(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void LinkNativeChannel(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  static void CreatePerIsolateProperties(IsolateData* isolate_data,
+                                         v8::Local<v8::ObjectTemplate> target);
+  static void CreatePerContextProperties(v8::Local<v8::Object> target,
+                                         v8::Local<v8::Value> unused,
+                                         v8::Local<v8::Context> context,
+                                         void* priv);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+ private:
+  InternalFieldInfo* internal_field_info_ = nullptr;
+};
+
+class Channel : public BaseObject {
+ public:
+  // Public for MakeDetachedBaseObject.
+  Channel(Environment* env,
+          v8::Local<v8::Object> wrap,
+          BindingData* binding_data,
+          uint32_t index,
+          std::string name);
+
+  // Returns a non-owning pointer. Lifetime is managed by BindingData.
+  static Channel* Get(Environment* env, const char* name);
+
+  inline bool HasSubscribers() const {
+    return binding_data_ != nullptr && binding_data_->subscribers_[index_] > 0;
+  }
+
+  void Publish(Environment* env, v8::Local<v8::Value> message);
+
+  void Link(v8::Isolate* isolate, v8::Local<v8::Object> js_channel);
+
+  inline bool IsLinked() const { return !js_channel_.IsEmpty(); }
+
+  void Unlink();
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(Channel)
+  SET_SELF_SIZE(Channel)
+
+ private:
+  friend class BindingData;
+
+  void CachePublishFn(v8::Isolate* isolate, v8::Local<v8::Object> js_channel);
+
+  BindingData* binding_data_;
+  uint32_t index_;
+  std::string name_;
+  v8::Global<v8::Object> js_channel_;
+  v8::Global<v8::Function> publish_fn_;
+};
+
+}  // namespace diagnostics_channel
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_NODE_DIAGNOSTICS_CHANNEL_H_
diff --git a/src/node_external_reference.h b/src/node_external_reference.h
index 835471d4f70846..5ce9ec0a8c207b 100644
--- a/src/node_external_reference.h
+++ b/src/node_external_reference.h
@@ -71,6 +71,7 @@ class ExternalReferenceRegistry {
   V(config)                                                                    \
   V(contextify)                                                                \
   V(credentials)                                                               \
+  V(diagnostics_channel)                                                       \
   V(encoding_binding)                                                          \
   V(env_var)                                                                   \
   V(errors)                                                                    \
diff --git a/src/node_options.cc b/src/node_options.cc
index 22fe0f61da8c69..4496875c4f5174 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -635,6 +635,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
+  AddOption("--permission-audit",
+            "enable audit only for the permission system",
+            &EnvironmentOptions::permission_audit,
+            kAllowedInEnvvar,
+            false);
   AddOption("--allow-fs-read",
             "allow permissions to read the filesystem",
             &EnvironmentOptions::allow_fs_read,
diff --git a/src/node_options.h b/src/node_options.h
index 21f43946ea8a1e..8bbac8d692807e 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -138,6 +138,7 @@ class EnvironmentOptions : public Options {
   std::string input_type;  // Value of --input-type
   bool entry_is_url = false;
   bool permission = false;
+  bool permission_audit = false;
   std::vector<std::string> allow_fs_read;
   std::vector<std::string> allow_fs_write;
   bool allow_addons = false;
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index 30df4f53abc446..f90e5f28ac28a9 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -14,6 +14,7 @@
 #include "node_blob.h"
 #include "node_builtins.h"
 #include "node_contextify.h"
+#include "node_diagnostics_channel.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "node_file.h"
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 2d0e1723050e30..f845044b18a717 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -3,6 +3,7 @@
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
 #include "node.h"
+#include "node_diagnostics_channel.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "node_file.h"
@@ -27,6 +28,29 @@ namespace permission {
 
 namespace {
 
+constexpr std::string_view GetDiagnosticsChannelName(PermissionScope scope) {
+  switch (scope) {
+    case PermissionScope::kFileSystem:
+    case PermissionScope::kFileSystemRead:
+    case PermissionScope::kFileSystemWrite:
+      return "node:permission-model:fs";
+    case PermissionScope::kChildProcess:
+      return "node:permission-model:child";
+    case PermissionScope::kWorkerThreads:
+      return "node:permission-model:worker";
+    case PermissionScope::kNet:
+      return "node:permission-model:net";
+    case PermissionScope::kInspector:
+      return "node:permission-model:inspector";
+    case PermissionScope::kWASI:
+      return "node:permission-model:wasi";
+    case PermissionScope::kAddon:
+      return "node:permission-model:addon";
+    default:
+      return {};
+  }
+}
+
 // permission.has('fs.in', '/tmp/')
 // permission.has('fs.in')
 static void Has(const FunctionCallbackInfo<Value>& args) {
@@ -70,7 +94,7 @@ PermissionScope Permission::StringToPermission(const std::string& perm) {
 }
 #undef V
 
-Permission::Permission() : enabled_(false) {
+Permission::Permission() : enabled_(false), warning_only_(false) {
   std::shared_ptr<PermissionBase> fs = std::make_shared<FSPermission>();
   std::shared_ptr<PermissionBase> child_p =
       std::make_shared<ChildProcessPermission>();
@@ -175,6 +199,74 @@ void Permission::EnablePermissions() {
   }
 }
 
+void Permission::EnableWarningOnly() {
+  if (!warning_only_) {
+    warning_only_ = true;
+  }
+}
+
+bool Permission::is_scope_granted(Environment* env,
+                                  const PermissionScope permission,
+                                  const std::string_view& res) const {
+  auto perm_node = nodes_.find(permission);
+  bool result = false;
+  if (perm_node != nodes_.end()) {
+    result = perm_node->second->is_granted(env, permission, res);
+  }
+
+  if (!result && !publishing_) {
+    auto channel_name = GetDiagnosticsChannelName(permission);
+    if (!channel_name.empty()) {
+      auto ch = GetOrCreateChannel(env, permission);
+      if (ch && ch->HasSubscribers()) {
+        publishing_ = true;
+        v8::Isolate* isolate = env->isolate();
+        v8::HandleScope handle_scope(isolate);
+        v8::Local<v8::Context> context = env->context();
+        v8::Local<v8::Object> msg =
+            v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);
+        const char* perm_str = PermissionToString(permission);
+        msg->Set(context,
+                 FIXED_ONE_BYTE_STRING(isolate, "permission"),
+                 v8::String::NewFromUtf8(isolate, perm_str).ToLocalChecked())
+            .Check();
+        msg->Set(context,
+                 FIXED_ONE_BYTE_STRING(isolate, "resource"),
+                 v8::String::NewFromUtf8(isolate,
+                                         res.data(),
+                                         v8::NewStringType::kNormal,
+                                         static_cast<int>(res.size()))
+                     .ToLocalChecked())
+            .Check();
+        ch->Publish(env, msg);
+        publishing_ = false;
+      }
+    }
+  }
+
+  return result;
+}
+
+BaseObjectPtr<diagnostics_channel::Channel> Permission::GetOrCreateChannel(
+    Environment* env, PermissionScope scope) const {
+  auto it = channels_.find(scope);
+  if (it != channels_.end()) {
+    // Promote weak ref to strong for the duration of this call.
+    BaseObjectPtr<diagnostics_channel::Channel> ptr(it->second.get());
+    if (ptr) return ptr;
+    channels_.erase(it);
+  }
+  auto channel_name = GetDiagnosticsChannelName(scope);
+  diagnostics_channel::Channel* ch =
+      diagnostics_channel::Channel::Get(env, channel_name.data());
+  if (ch != nullptr) {
+    channels_.emplace(scope,
+                      BaseObjectWeakPtr<diagnostics_channel::Channel>(ch));
+    return BaseObjectPtr<diagnostics_channel::Channel>(ch);
+  }
+  return {};
+}
+
 void Permission::Apply(Environment* env,
                        const std::vector<std::string>& allow,
                        PermissionScope scope) {
diff --git a/src/permission/permission.h b/src/permission/permission.h
index f18a2ea1182c36..41efd41f36a880 100644
--- a/src/permission/permission.h
+++ b/src/permission/permission.h
@@ -4,6 +4,7 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include "debug_utils.h"
+#include "node_diagnostics_channel.h"
 #include "node_options.h"
 #include "permission/addon_permission.h"
 #include "permission/child_process_permission.h"
@@ -37,7 +38,7 @@ namespace permission {
         [[unlikely]] {                                                         \
       node::permission::Permission::ThrowAccessDenied(                         \
           env__, perm__, resource__);                                          \
-      return __VA_ARGS__;                                                      \
+      if (!env__->permission()->warning_only()) return __VA_ARGS__;            \
     }                                                                          \
   } while (0)
 
@@ -51,7 +52,7 @@ namespace permission {
         [[unlikely]] {                                                         \
       node::permission::Permission::AsyncThrowAccessDenied(                    \
           env__, (wrap), perm__, resource__);                                  \
-      return __VA_ARGS__;                                                      \
+      if (!env__->permission()->warning_only()) return __VA_ARGS__;            \
     }                                                                          \
   } while (0)
 
@@ -100,6 +101,8 @@ class Permission {
 
   FORCE_INLINE bool enabled() const { return enabled_; }
 
+  FORCE_INLINE bool warning_only() const { return warning_only_; }
+
   static PermissionScope StringToPermission(const std::string& perm);
   static const char* PermissionToString(PermissionScope perm);
   static void ThrowAccessDenied(Environment* env,
@@ -115,20 +118,25 @@ class Permission {
              const std::vector<std::string>& allow,
              PermissionScope scope);
   void EnablePermissions();
+  void EnableWarningOnly();
 
  private:
   COLD_NOINLINE bool is_scope_granted(Environment* env,
                                       const PermissionScope permission,
-                                      const std::string_view& res = "") const {
-    auto perm_node = nodes_.find(permission);
-    if (perm_node != nodes_.end()) {
-      return perm_node->second->is_granted(env, permission, res);
-    }
-    return false;
-  }
+                                      const std::string_view& res = "") const;
+
+  BaseObjectPtr<diagnostics_channel::Channel> GetOrCreateChannel(
+      Environment* env, PermissionScope scope) const;
 
   std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
   bool enabled_;
+  bool warning_only_;
+  mutable bool publishing_ = false;
+  // Weak refs: BindingData (via BaseObjectPtr) is the sole owner of Channels.
+  // Using weak refs here avoids keeping Channels alive past Realm teardown.
+  mutable std::unordered_map<PermissionScope,
+                             BaseObjectWeakPtr<diagnostics_channel::Channel>>
+      channels_;
 };
 
 v8::MaybeLocal<v8::Value> CreateAccessDeniedError(Environment* env,
diff --git a/test/cctest/test_diagnostics_channel.cc b/test/cctest/test_diagnostics_channel.cc
new file mode 100644
index 00000000000000..b456f6aaf9eaab
--- /dev/null
+++ b/test/cctest/test_diagnostics_channel.cc
@@ -0,0 +1,259 @@
+#include "node_diagnostics_channel.h"
+
+#include "gtest/gtest.h"
+#include "node_test_fixture.h"
+
+using node::diagnostics_channel::Channel;
+
+class DiagnosticsChannelTest : public EnvironmentTestFixture {};
+
+static v8::Local<v8::Value> RunJS(v8::Isolate* isolate, const char* code) {
+  v8::Local<v8::Context> context = isolate->GetCurrentContext();
+  v8::Local<v8::Script> script =
+      v8::Script::Compile(
+          context, v8::String::NewFromUtf8(isolate, code).ToLocalChecked())
+          .ToLocalChecked();
+  return script->Run(context).ToLocalChecked();
+}
+
+// Channel::HasSubscribers() returns false when there are no subscribers.
+TEST_F(DiagnosticsChannelTest, HasSubscribersReturnsFalseWithoutSubscribers) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  // Load the environment to initialize bindings.
+  node::LoadEnvironment(*env, "require('diagnostics_channel');");
+
+  auto ch = Channel::Get(*env, "test:cctest:no-subscribers");
+  ASSERT_NE(ch, nullptr);
+  EXPECT_FALSE(ch->HasSubscribers());
+}
+
+// Channel::HasSubscribers() returns true after JS subscribes.
+TEST_F(DiagnosticsChannelTest, HasSubscribersReturnsTrueAfterSubscribe) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  node::LoadEnvironment(*env,
+                        "const dc = require('diagnostics_channel');"
+                        "dc.subscribe('test:cctest:with-sub', () => {});");
+
+  auto ch = Channel::Get(*env, "test:cctest:with-sub");
+  ASSERT_NE(ch, nullptr);
+  EXPECT_TRUE(ch->HasSubscribers());
+}
+
+// Channel::Get() with the same name returns consistent subscriber state.
+TEST_F(DiagnosticsChannelTest, GetReturnsSameChannelState) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  node::LoadEnvironment(*env,
+                        "const dc = require('diagnostics_channel');"
+                        "dc.subscribe('test:cctest:same-channel', () => {});");
+
+  auto ch1 = Channel::Get(*env, "test:cctest:same-channel");
+  auto ch2 = Channel::Get(*env, "test:cctest:same-channel");
+  ASSERT_NE(ch1, nullptr);
+  ASSERT_NE(ch2, nullptr);
+  EXPECT_TRUE(ch1->HasSubscribers());
+  EXPECT_TRUE(ch2->HasSubscribers());
+  EXPECT_EQ(ch1, ch2);
+}
+
+// Channel::Publish() delivers messages to JS subscribers.
+TEST_F(DiagnosticsChannelTest, PublishDeliversToJSSubscribers) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  node::LoadEnvironment(
+      *env,
+      "const dc = require('diagnostics_channel');"
+      "const assert = require('assert');"
+      "dc.subscribe('test:cctest:publish', (message, name) => {"
+      "  assert.strictEqual(name, 'test:cctest:publish');"
+      "  assert.strictEqual(message.value, 42);"
+      "  globalThis.__publishReceived = true;"
+      "});");
+
+  v8::Local<v8::Context> context = (*env)->context();
+
+  auto ch = Channel::Get(*env, "test:cctest:publish");
+  ASSERT_NE(ch, nullptr);
+  ASSERT_TRUE(ch->HasSubscribers());
+
+  v8::Local<v8::Object> msg = v8::Object::New(isolate_);
+  msg->Set(context,
+           v8::String::NewFromUtf8Literal(isolate_, "value"),
+           v8::Integer::New(isolate_, 42))
+      .Check();
+
+  ch->Publish(*env, msg);
+
+  v8::Local<v8::Value> received =
+      context->Global()
+          ->Get(context,
+                v8::String::NewFromUtf8Literal(isolate_, "__publishReceived"))
+          .ToLocalChecked();
+  EXPECT_TRUE(received->IsTrue());
+}
+
+// C++ creates a channel first, then JS subscribes to the same name.
+// Verifies C++ Channel reflects the JS subscriber via the shared buffer.
+TEST_F(DiagnosticsChannelTest, CppChannelVisibleFromJS) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  // Expose dc on globalThis so RunJS (v8::Script) can access it.
+  node::LoadEnvironment(*env,
+                        "globalThis.__dc = require('diagnostics_channel');");
+
+  auto ch = Channel::Get(*env, "test:cctest:cpp-first");
+  ASSERT_NE(ch, nullptr);
+  EXPECT_FALSE(ch->HasSubscribers());
+
+  // JS subscribes to the same channel name via globalThis.__dc.
+  RunJS(isolate_,
+        "globalThis.__dc.subscribe('test:cctest:cpp-first', () => {});");
+
+  EXPECT_TRUE(ch->HasSubscribers());
+
+  RunJS(isolate_,
+        "globalThis.__cppFirstMsg = null;"
+        "globalThis.__dc.subscribe('test:cctest:cpp-first', (msg) => {"
+        "  globalThis.__cppFirstMsg = msg;"
+        "});");
+
+  v8::Local<v8::Context> context = (*env)->context();
+  v8::Local<v8::Object> msg = v8::Object::New(isolate_);
+  msg->Set(context,
+           v8::String::NewFromUtf8Literal(isolate_, "from"),
+           v8::String::NewFromUtf8Literal(isolate_, "cpp"))
+      .Check();
+
+  ch->Publish(*env, msg);
+
+  v8::Local<v8::Value> received =
+      context->Global()
+          ->Get(context,
+                v8::String::NewFromUtf8Literal(isolate_, "__cppFirstMsg"))
+          .ToLocalChecked();
+  ASSERT_TRUE(received->IsObject());
+  v8::Local<v8::Value> from_val =
+      received.As<v8::Object>()
+          ->Get(context, v8::String::NewFromUtf8Literal(isolate_, "from"))
+          .ToLocalChecked();
+  v8::String::Utf8Value from_str(isolate_, from_val);
+  EXPECT_STREQ(*from_str, "cpp");
+}
+
+// JS creates a channel and subscribes, then C++ gets the same channel,
+// verifies it shares state, and publishes messages that JS receives.
+TEST_F(DiagnosticsChannelTest, JSChannelVisibleFromCpp) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  node::LoadEnvironment(*env,
+                        "const dc = require('diagnostics_channel');"
+                        "globalThis.__dc = dc;"
+                        "globalThis.__jsFirstMessages = [];"
+                        "dc.subscribe('test:cctest:js-first', (msg) => {"
+                        "  globalThis.__jsFirstMessages.push(msg);"
+                        "});");
+
+  v8::Local<v8::Context> context = (*env)->context();
+
+  auto ch = Channel::Get(*env, "test:cctest:js-first");
+  ASSERT_NE(ch, nullptr);
+  ASSERT_TRUE(ch->HasSubscribers());
+
+  // Publish from C++ — JS subscriber should receive it.
+  v8::Local<v8::Object> msg1 = v8::Object::New(isolate_);
+  msg1->Set(context,
+            v8::String::NewFromUtf8Literal(isolate_, "seq"),
+            v8::Integer::New(isolate_, 1))
+      .Check();
+  ch->Publish(*env, msg1);
+
+  v8::Local<v8::Object> msg2 = v8::Object::New(isolate_);
+  msg2->Set(context,
+            v8::String::NewFromUtf8Literal(isolate_, "seq"),
+            v8::Integer::New(isolate_, 2))
+      .Check();
+  ch->Publish(*env, msg2);
+
+  v8::Local<v8::Value> msgs_val =
+      context->Global()
+          ->Get(context,
+                v8::String::NewFromUtf8Literal(isolate_, "__jsFirstMessages"))
+          .ToLocalChecked();
+  ASSERT_TRUE(msgs_val->IsArray());
+  v8::Local<v8::Array> msgs = msgs_val.As<v8::Array>();
+  EXPECT_EQ(msgs->Length(), 2u);
+
+  // Check first message: { seq: 1 }
+  v8::Local<v8::Value> m1 = msgs->Get(context, 0).ToLocalChecked();
+  ASSERT_TRUE(m1->IsObject());
+  v8::Local<v8::Value> seq1 =
+      m1.As<v8::Object>()
+          ->Get(context, v8::String::NewFromUtf8Literal(isolate_, "seq"))
+          .ToLocalChecked();
+  EXPECT_EQ(seq1->Int32Value(context).FromJust(), 1);
+
+  // Check second message: { seq: 2 }
+  v8::Local<v8::Value> m2 = msgs->Get(context, 1).ToLocalChecked();
+  ASSERT_TRUE(m2->IsObject());
+  v8::Local<v8::Value> seq2 =
+      m2.As<v8::Object>()
+          ->Get(context, v8::String::NewFromUtf8Literal(isolate_, "seq"))
+          .ToLocalChecked();
+  EXPECT_EQ(seq2->Int32Value(context).FromJust(), 2);
+
+  RunJS(isolate_,
+        "globalThis.__jsHasSubs ="
+        "  globalThis.__dc.hasSubscribers('test:cctest:js-first');");
+
+  v8::Local<v8::Value> js_has_subs =
+      context->Global()
+          ->Get(context,
+                v8::String::NewFromUtf8Literal(isolate_, "__jsHasSubs"))
+          .ToLocalChecked();
+  EXPECT_TRUE(js_has_subs->IsTrue());
+  EXPECT_TRUE(ch->HasSubscribers());
+}
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index 67a59c3ff7f105..92bf3be1f612ff 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -105,6 +105,7 @@ expected.beforePreExec = new Set([
   'Internal Binding module_wrap',
   'NativeModule internal/modules/cjs/loader',
   'NativeModule diagnostics_channel',
+  'Internal Binding diagnostics_channel',
   'Internal Binding wasm_web_api',
   'NativeModule internal/events/abort_listener',
   'NativeModule internal/modules/typescript',
diff --git a/test/parallel/test-permission-diagnostics-channel.js b/test/parallel/test-permission-diagnostics-channel.js
new file mode 100644
index 00000000000000..add99d5f8f0970
--- /dev/null
+++ b/test/parallel/test-permission-diagnostics-channel.js
@@ -0,0 +1,29 @@
+// Flags: --permission --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('node:assert');
+const dc = require('node:diagnostics_channel');
+const fs = require('node:fs');
+
+const messages = [];
+dc.subscribe('node:permission-model:fs', (msg) => {
+  messages.push(msg);
+});
+
+// Granted permission should not publish
+fs.readFileSync(__filename);
+assert.strictEqual(messages.length, 0);
+
+// Denied permission should publish
+const hasWrite = process.permission.has('fs.write', '/tmp/test');
+assert.strictEqual(hasWrite, false);
+
+assert.ok(messages.length > 0, 'Expected at least one denied message');
+assert.strictEqual(messages[0].permission, 'FileSystemWrite');