diff --git a/doc/api/cli.md b/doc/api/cli.md
index 651e06f6910ebe..3387fb0981e30b 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -2174,6 +2174,16 @@ following permissions are restricted:
 * WASI - manageable through [`--allow-wasi`][] flag
 * Addons - manageable through [`--allow-addons`][] flag
 
+### `--permission-audit`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Enable audit only for the permission model. When enabled, permission checks
+are performed but access is not denied. Instead, a warning is emitted for
+each permission violation via diagnostics channel.
+
 ### `--preserve-symlinks`
 
 <!-- YAML
@@ -3660,6 +3670,7 @@ one is included in the list below.
 * `--openssl-legacy-provider`
 * `--openssl-shared-config`
 * `--pending-deprecation`
+* `--permission-audit`
 * `--permission`
 * `--preserve-symlinks-main`
 * `--preserve-symlinks`
diff --git a/doc/node.1 b/doc/node.1
index 6d16ef84c45df0..03806d8b502e69 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -1115,6 +1115,11 @@ WASI - manageable through \fB--allow-wasi\fR flag
 Addons - manageable through \fB--allow-addons\fR flag
 .El
 .
+.It Fl -permission-audit
+Enable audit only for the permission model. When enabled, permission checks
+are performed but access is not denied. Instead, a warning is emitted for
+each permission violation via diagnostics channel.
+.
 .It Fl -preserve-symlinks
 Instructs the module loader to preserve symbolic links when resolving and
 caching modules.
@@ -1978,6 +1983,8 @@ one is included in the list below.
 .It
 \fB--permission\fR
 .It
+\fB--permission-audit\fR
+.It
 \fB--preserve-symlinks-main\fR
 .It
 \fB--preserve-symlinks\fR
diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index 3deb301e7f3cd2..bd17965b131208 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -31,6 +31,9 @@ const {
 
 const { triggerUncaughtException } = internalBinding('errors');
 
+const dc_binding = internalBinding('diagnostics_channel');
+const { subscribers: subscriberCounts } = dc_binding;
+
 const { WeakReference } = require('internal/util');
 
 // Can't delete when weakref count reaches 0 as it could increment again.
@@ -108,6 +111,7 @@ class ActiveChannel {
     this._subscribers = ArrayPrototypeSlice(this._subscribers);
     ArrayPrototypePush(this._subscribers, subscription);
     channels.incRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]++;
   }
 
   unsubscribe(subscription) {
@@ -120,6 +124,7 @@ class ActiveChannel {
     ArrayPrototypePushApply(this._subscribers, after);
 
     channels.decRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]--;
     maybeMarkInactive(this);
 
     return true;
@@ -127,7 +132,10 @@ class ActiveChannel {
 
   bindStore(store, transform) {
     const replacing = this._stores.has(store);
-    if (!replacing) channels.incRef(this.name);
+    if (!replacing) {
+      channels.incRef(this.name);
+      if (this._index !== undefined) subscriberCounts[this._index]++;
+    }
     this._stores.set(store, transform);
   }
 
@@ -139,6 +147,7 @@ class ActiveChannel {
     this._stores.delete(store);
 
     channels.decRef(this.name);
+    if (this._index !== undefined) subscriberCounts[this._index]--;
     maybeMarkInactive(this);
 
     return true;
@@ -183,6 +192,9 @@ class Channel {
     this._subscribers = undefined;
     this._stores = undefined;
     this.name = name;
+    if (typeof name === 'string') {
+      this._index = dc_binding.getOrCreateChannelIndex(name);
+    }
 
     channels.set(name, this);
   }
@@ -434,6 +446,8 @@ function tracingChannel(nameOrChannels) {
   return new TracingChannel(nameOrChannels);
 }
 
+dc_binding.linkNativeChannel((name) => channel(name));
+
 module.exports = {
   channel,
   hasSubscribers,
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index 0902536708bf1d..b743e321f198ec 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -124,6 +124,8 @@ function prepareExecution(options) {
   // Process initial diagnostic reporting configuration, if present.
   initializeReport();
 
+  setupDiagnosticsChannel();
+
   // Load permission system API
   initializePermission();
 
@@ -619,8 +621,16 @@ function initializeClusterIPC() {
   }
 }
 
+function setupDiagnosticsChannel() {
+  // Re-link native channels after snapshot deserialization since
+  // JS references are cleared during serialization.
+  const dc = require('diagnostics_channel');
+  const dc_binding = internalBinding('diagnostics_channel');
+  dc_binding.linkNativeChannel((name) => dc.channel(name));
+}
+
 function initializePermission() {
-  const permission = getOptionValue('--permission');
+  const permission = getOptionValue('--permission') || getOptionValue('--permission-audit');
   if (permission) {
     process.binding = function binding(_module) {
       throw new ERR_ACCESS_DENIED('process.binding');
diff --git a/node.gyp b/node.gyp
index 566377625bc712..b11b8e154c49d7 100644
--- a/node.gyp
+++ b/node.gyp
@@ -133,6 +133,7 @@
       'src/node_main_instance.cc',
       'src/node_messaging.cc',
       'src/node_metadata.cc',
+      'src/node_diagnostics_channel.cc',
       'src/node_modules.cc',
       'src/node_options.cc',
       'src/node_os.cc',
@@ -270,6 +271,7 @@
       'src/node_messaging.h',
       'src/node_metadata.h',
       'src/node_mutex.h',
+      'src/node_diagnostics_channel.h',
       'src/node_modules.h',
       'src/node_object_wrap.h',
       'src/node_options.h',
diff --git a/src/base_object_types.h b/src/base_object_types.h
index 9cfe6a77f71708..cd1a06e41a3071 100644
--- a/src/base_object_types.h
+++ b/src/base_object_types.h
@@ -10,6 +10,7 @@ namespace node {
 // what the class passes to SET_BINDING_ID(), the second argument should match
 // the C++ class name.
 #define SERIALIZABLE_BINDING_TYPES(V)                                          \
+  V(diagnostics_channel_binding_data, diagnostics_channel::BindingData)        \
   V(encoding_binding_data, encoding_binding::BindingData)                      \
   V(fs_binding_data, fs::BindingData)                                          \
   V(mksnapshot_binding_data, mksnapshot::BindingData)                          \
diff --git a/src/env.cc b/src/env.cc
index 6df324e04316c5..f4cfcc2a4493e8 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -918,8 +918,11 @@ Environment::Environment(IsolateData* isolate_data,
                                       tracing::CastTracedValue(traced_value));
   }
 
-  if (options_->permission) {
+  if (options_->permission || options_->permission_audit) {
     permission()->EnablePermissions();
+    if (options_->permission_audit) {
+      permission()->EnableWarningOnly();
+    }
     // The process shouldn't be able to neither
     // spawn/worker nor use addons or enable inspector
     // unless explicitly allowed by the user
diff --git a/src/node_binding.cc b/src/node_binding.cc
index 740706e917b7d2..b76ecc8cab47df 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -48,6 +48,7 @@
   V(constants)                                                                 \
   V(contextify)                                                                \
   V(credentials)                                                               \
+  V(diagnostics_channel)                                                       \
   V(encoding_binding)                                                          \
   V(errors)                                                                    \
   V(fs)                                                                        \
diff --git a/src/node_binding.h b/src/node_binding.h
index dbb4c137afc776..83f8cee7c9f7b0 100644
--- a/src/node_binding.h
+++ b/src/node_binding.h
@@ -49,6 +49,7 @@ static_assert(static_cast<int>(NM_F_LINKED) ==
   V(blob)                                                                      \
   V(builtins)                                                                  \
   V(contextify)                                                                \
+  V(diagnostics_channel)                                                       \
   V(encoding_binding)                                                          \
   V(fs)                                                                        \
   V(fs_dir)                                                                    \
diff --git a/src/node_diagnostics_channel.cc b/src/node_diagnostics_channel.cc
new file mode 100644
index 00000000000000..e3a9c4a3f882f8
--- /dev/null
+++ b/src/node_diagnostics_channel.cc
@@ -0,0 +1,234 @@
+#include "node_diagnostics_channel.h"
+
+#include "env-inl.h"
+#include "node_external_reference.h"
+#include "util-inl.h"
+#include "v8.h"
+
+#include <cstdint>
+
+namespace node {
+namespace diagnostics_channel {
+
+using v8::Context;
+using v8::Function;
+using v8::FunctionCallbackInfo;
+using v8::HandleScope;
+using v8::Isolate;
+using v8::Local;
+using v8::Object;
+using v8::ObjectTemplate;
+using v8::SnapshotCreator;
+using v8::String;
+using v8::Value;
+
+BindingData::BindingData(Realm* realm,
+                         Local<Object> wrap,
+                         InternalFieldInfo* info)
+    : SnapshotableObject(realm, wrap, type_int),
+      subscribers_(
+          realm->isolate(), kMaxChannels, MAYBE_FIELD_PTR(info, subscribers)) {
+  if (info == nullptr) {
+    wrap->Set(realm->context(),
+              FIXED_ONE_BYTE_STRING(realm->isolate(), "subscribers"),
+              subscribers_.GetJSArray())
+        .Check();
+  } else {
+    subscribers_.Deserialize(realm->context());
+  }
+  subscribers_.MakeWeak();
+}
+
+void BindingData::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("subscribers", subscribers_);
+}
+
+uint32_t BindingData::GetOrCreateChannelIndex(const std::string& name) {
+  auto it = channel_indices_.find(name);
+  if (it != channel_indices_.end()) {
+    return it->second;
+  }
+  CHECK_LT(next_channel_index_, kMaxChannels);
+  uint32_t index = next_channel_index_++;
+  channel_indices_.emplace(name, index);
+  return index;
+}
+
+void BindingData::GetOrCreateChannelIndex(
+    const FunctionCallbackInfo<Value>& args) {
+  Realm* realm = Realm::GetCurrent(args);
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  CHECK_NOT_NULL(binding);
+
+  CHECK(args[0]->IsString());
+  Utf8Value name(realm->isolate(), args[0]);
+
+  uint32_t index = binding->GetOrCreateChannelIndex(*name);
+  args.GetReturnValue().Set(index);
+}
+
+void BindingData::LinkNativeChannel(const FunctionCallbackInfo<Value>& args) {
+  Realm* realm = Realm::GetCurrent(args);
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  CHECK_NOT_NULL(binding);
+
+  CHECK(args[0]->IsFunction());
+  Isolate* isolate = realm->isolate();
+  Local<Context> context = realm->context();
+  binding->link_callback_.Reset(isolate, args[0].As<Function>());
+
+  // Resolve channels created before the link callback was available.
+  for (uint32_t index : binding->pending_channels_) {
+    for (const auto& pair : binding->channel_indices_) {
+      if (pair.second == index) {
+        Local<String> name =
+            String::NewFromUtf8(isolate, pair.first.c_str()).ToLocalChecked();
+        Local<Value> argv[] = {name};
+        Local<Value> result;
+        if (binding->link_callback_.Get(isolate)
+                ->Call(context, v8::Undefined(isolate), 1, argv)
+                .ToLocal(&result) &&
+            result->IsObject()) {
+          if (index >= binding->js_channels_.size()) {
+            binding->js_channels_.resize(index + 1);
+          }
+          binding->js_channels_[index].Reset(isolate, result.As<Object>());
+        }
+        break;
+      }
+    }
+  }
+  binding->pending_channels_.clear();
+}
+
+bool BindingData::PrepareForSerialization(Local<Context> context,
+                                          SnapshotCreator* creator) {
+  DCHECK_NULL(internal_field_info_);
+  internal_field_info_ = InternalFieldInfoBase::New<InternalFieldInfo>(type());
+  internal_field_info_->subscribers = subscribers_.Serialize(context, creator);
+  link_callback_.Reset();
+  for (auto& global : js_channels_) {
+    global.Reset();
+  }
+  return true;
+}
+
+InternalFieldInfoBase* BindingData::Serialize(int index) {
+  DCHECK_IS_SNAPSHOT_SLOT(index);
+  InternalFieldInfo* info = internal_field_info_;
+  internal_field_info_ = nullptr;
+  return info;
+}
+
+void BindingData::Deserialize(Local<Context> context,
+                              Local<Object> holder,
+                              int index,
+                              InternalFieldInfoBase* info) {
+  DCHECK_IS_SNAPSHOT_SLOT(index);
+  HandleScope scope(Isolate::GetCurrent());
+  Realm* realm = Realm::GetCurrent(context);
+  BindingData* binding = realm->AddBindingData<BindingData>(
+      holder, static_cast<InternalFieldInfo*>(info));
+  CHECK_NOT_NULL(binding);
+}
+
+void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
+                                             Local<ObjectTemplate> target) {
+  Isolate* isolate = isolate_data->isolate();
+  SetMethod(
+      isolate, target, "getOrCreateChannelIndex", GetOrCreateChannelIndex);
+  SetMethod(isolate, target, "linkNativeChannel", LinkNativeChannel);
+}
+
+void BindingData::CreatePerContextProperties(Local<Object> target,
+                                             Local<Value> unused,
+                                             Local<Context> context,
+                                             void* priv) {
+  Realm* realm = Realm::GetCurrent(context);
+  BindingData* const binding = realm->AddBindingData<BindingData>(target);
+  if (binding == nullptr) return;
+}
+
+void BindingData::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(GetOrCreateChannelIndex);
+  registry->Register(LinkNativeChannel);
+}
+
+Channel::Channel(BindingData* binding_data, uint32_t index)
+    : binding_data_(binding_data), index_(index) {}
+
+Channel Channel::Get(Environment* env, const char* name) {
+  Realm* realm = env->principal_realm();
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  if (binding == nullptr) {
+    return Channel(nullptr, 0);
+  }
+  uint32_t index = binding->GetOrCreateChannelIndex(std::string(name));
+
+  if (!binding->link_callback_.IsEmpty()) {
+    if (index >= binding->js_channels_.size()) {
+      binding->js_channels_.resize(index + 1);
+    }
+    if (binding->js_channels_[index].IsEmpty()) {
+      Isolate* isolate = env->isolate();
+      HandleScope handle_scope(isolate);
+      Local<Context> context = env->context();
+      Local<String> js_name =
+          String::NewFromUtf8(isolate, name).ToLocalChecked();
+      Local<Value> argv[] = {js_name};
+      Local<Value> result;
+      if (binding->link_callback_.Get(isolate)
+              ->Call(context, v8::Undefined(isolate), 1, argv)
+              .ToLocal(&result) &&
+          result->IsObject()) {
+        binding->js_channels_[index].Reset(isolate, result.As<Object>());
+      }
+    }
+  } else {
+    binding->pending_channels_.push_back(index);
+  }
+
+  return Channel(binding, index);
+}
+
+void Channel::Publish(Environment* env, Local<Value> message) const {
+  if (!HasSubscribers()) return;
+
+  if (binding_data_ == nullptr) return;
+
+  Isolate* isolate = env->isolate();
+  HandleScope handle_scope(isolate);
+  Local<Context> context = env->context();
+  Context::Scope context_scope(context);
+
+  if (index_ >= binding_data_->js_channels_.size() ||
+      binding_data_->js_channels_[index_].IsEmpty()) {
+    return;
+  }
+
+  Local<Object> js_channel =
+      binding_data_->js_channels_[index_].Get(isolate);
+  Local<Value> publish_val;
+  if (!js_channel->Get(context, FIXED_ONE_BYTE_STRING(isolate, "publish"))
+           .ToLocal(&publish_val) ||
+      !publish_val->IsFunction()) {
+    return;
+  }
+
+  Local<Value> argv[] = {message};
+  USE(publish_val.As<Function>()->Call(context, js_channel, 1, argv));
+}
+
+}  // namespace diagnostics_channel
+}  // namespace node
+
+NODE_BINDING_CONTEXT_AWARE_INTERNAL(
+    diagnostics_channel,
+    node::diagnostics_channel::BindingData::CreatePerContextProperties)
+NODE_BINDING_PER_ISOLATE_INIT(
+    diagnostics_channel,
+    node::diagnostics_channel::BindingData::CreatePerIsolateProperties)
+NODE_BINDING_EXTERNAL_REFERENCE(
+    diagnostics_channel,
+    node::diagnostics_channel::BindingData::RegisterExternalReferences)
diff --git a/src/node_diagnostics_channel.h b/src/node_diagnostics_channel.h
new file mode 100644
index 00000000000000..cd42ceb0f702da
--- /dev/null
+++ b/src/node_diagnostics_channel.h
@@ -0,0 +1,91 @@
+#ifndef SRC_NODE_DIAGNOSTICS_CHANNEL_H_
+#define SRC_NODE_DIAGNOSTICS_CHANNEL_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <cinttypes>
+#include <string>
+#include <unordered_map>
+#include <vector>
+#include "aliased_buffer.h"
+#include "node_snapshotable.h"
+
+namespace node {
+class ExternalReferenceRegistry;
+
+namespace diagnostics_channel {
+
+class Channel;
+
+class BindingData : public SnapshotableObject {
+ public:
+  static constexpr size_t kMaxChannels = 1024;
+
+  struct InternalFieldInfo : public node::InternalFieldInfoBase {
+    AliasedBufferIndex subscribers;
+  };
+
+  BindingData(Realm* realm,
+              v8::Local<v8::Object> wrap,
+              InternalFieldInfo* info = nullptr);
+
+  SERIALIZABLE_OBJECT_METHODS()
+  SET_BINDING_ID(diagnostics_channel_binding_data)
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_SELF_SIZE(BindingData)
+  SET_MEMORY_INFO_NAME(BindingData)
+
+  AliasedUint32Array subscribers_;
+
+  uint32_t next_channel_index_ = 0;
+  std::unordered_map<std::string, uint32_t> channel_indices_;
+
+  uint32_t GetOrCreateChannelIndex(const std::string& name);
+
+  v8::Global<v8::Function> link_callback_;
+  std::vector<v8::Global<v8::Object>> js_channels_;
+  std::vector<uint32_t> pending_channels_;
+
+  static void GetOrCreateChannelIndex(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void LinkNativeChannel(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  static void CreatePerIsolateProperties(IsolateData* isolate_data,
+                                         v8::Local<v8::ObjectTemplate> target);
+  static void CreatePerContextProperties(v8::Local<v8::Object> target,
+                                         v8::Local<v8::Value> unused,
+                                         v8::Local<v8::Context> context,
+                                         void* priv);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+ private:
+  InternalFieldInfo* internal_field_info_ = nullptr;
+};
+
+class Channel {
+ public:
+  static Channel Get(Environment* env, const char* name);
+
+  inline bool HasSubscribers() const {
+    return binding_data_ != nullptr && binding_data_->subscribers_[index_] > 0;
+  }
+
+  void Publish(Environment* env, v8::Local<v8::Value> message) const;
+
+ private:
+  friend class BindingData;
+
+  Channel(BindingData* binding_data, uint32_t index);
+
+  BindingData* binding_data_;
+  uint32_t index_;
+};
+
+}  // namespace diagnostics_channel
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_NODE_DIAGNOSTICS_CHANNEL_H_
diff --git a/src/node_external_reference.h b/src/node_external_reference.h
index 835471d4f70846..5ce9ec0a8c207b 100644
--- a/src/node_external_reference.h
+++ b/src/node_external_reference.h
@@ -71,6 +71,7 @@ class ExternalReferenceRegistry {
   V(config)                                                                    \
   V(contextify)                                                                \
   V(credentials)                                                               \
+  V(diagnostics_channel)                                                       \
   V(encoding_binding)                                                          \
   V(env_var)                                                                   \
   V(errors)                                                                    \
diff --git a/src/node_options.cc b/src/node_options.cc
index 22fe0f61da8c69..4496875c4f5174 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -635,6 +635,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar,
             false,
             OptionNamespaces::kPermissionNamespace);
+  AddOption("--permission-audit",
+            "enable audit only for the permission system",
+            &EnvironmentOptions::permission_audit,
+            kAllowedInEnvvar,
+            false);
   AddOption("--allow-fs-read",
             "allow permissions to read the filesystem",
             &EnvironmentOptions::allow_fs_read,
diff --git a/src/node_options.h b/src/node_options.h
index 21f43946ea8a1e..8bbac8d692807e 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -138,6 +138,7 @@ class EnvironmentOptions : public Options {
   std::string input_type;  // Value of --input-type
   bool entry_is_url = false;
   bool permission = false;
+  bool permission_audit = false;
   std::vector<std::string> allow_fs_read;
   std::vector<std::string> allow_fs_write;
   bool allow_addons = false;
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index 5f39029563eecb..0c7a4cd35bae8f 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -14,6 +14,7 @@
 #include "node_blob.h"
 #include "node_builtins.h"
 #include "node_contextify.h"
+#include "node_diagnostics_channel.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "node_file.h"
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 2d0e1723050e30..90dca6a0dea151 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -3,6 +3,7 @@
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
 #include "node.h"
+#include "node_diagnostics_channel.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "node_file.h"
@@ -27,6 +28,29 @@ namespace permission {
 
 namespace {
 
+constexpr std::string_view GetDiagnosticsChannelName(PermissionScope scope) {
+  switch (scope) {
+    case PermissionScope::kFileSystem:
+    case PermissionScope::kFileSystemRead:
+    case PermissionScope::kFileSystemWrite:
+      return "node:permission-model:fs";
+    case PermissionScope::kChildProcess:
+      return "node:permission-model:child";
+    case PermissionScope::kWorkerThreads:
+      return "node:permission-model:worker";
+    case PermissionScope::kNet:
+      return "node:permission-model:net";
+    case PermissionScope::kInspector:
+      return "node:permission-model:inspector";
+    case PermissionScope::kWASI:
+      return "node:permission-model:wasi";
+    case PermissionScope::kAddon:
+      return "node:permission-model:addon";
+    default:
+      return nullptr;
+  }
+}
+
 // permission.has('fs.in', '/tmp/')
 // permission.has('fs.in')
 static void Has(const FunctionCallbackInfo<Value>& args) {
@@ -70,7 +94,7 @@ PermissionScope Permission::StringToPermission(const std::string& perm) {
 }
 #undef V
 
-Permission::Permission() : enabled_(false) {
+Permission::Permission() : enabled_(false), warning_only_(false) {
   std::shared_ptr<PermissionBase> fs = std::make_shared<FSPermission>();
   std::shared_ptr<PermissionBase> child_p =
       std::make_shared<ChildProcessPermission>();
@@ -175,6 +199,67 @@ void Permission::EnablePermissions() {
   }
 }
 
+void Permission::EnableWarningOnly() {
+  if (!warning_only_) {
+    warning_only_ = true;
+  }
+}
+
+bool Permission::is_scope_granted(Environment* env,
+                                  const PermissionScope permission,
+                                  const std::string_view& res) const {
+  auto perm_node = nodes_.find(permission);
+  bool result = false;
+  if (perm_node != nodes_.end()) {
+    result = perm_node->second->is_granted(env, permission, res);
+  }
+
+  if (!result && !publishing_) {
+    auto channel_name = GetDiagnosticsChannelName(permission);
+    if (channel_name != nullptr) {
+      diagnostics_channel::Channel ch =
+          GetOrCreateChannel(env, permission);
+      if (ch.HasSubscribers()) {
+        publishing_ = true;
+        v8::Isolate* isolate = env->isolate();
+        v8::HandleScope handle_scope(isolate);
+        v8::Local<v8::Context> context = env->context();
+        v8::Local<v8::Object> msg = v8::Object::New(isolate, v8::Null(isolate), nullptr, nullptr, 0);
+        const char* perm_str = PermissionToString(permission);
+        msg->Set(context,
+                 FIXED_ONE_BYTE_STRING(isolate, "permission"),
+                 v8::String::NewFromUtf8(isolate, perm_str).ToLocalChecked())
+            .Check();
+        msg->Set(context,
+                 FIXED_ONE_BYTE_STRING(isolate, "resource"),
+                 v8::String::NewFromUtf8(isolate,
+                                         res.data(),
+                                         v8::NewStringType::kNormal,
+                                         static_cast<int>(res.size()))
+                     .ToLocalChecked())
+            .Check();
+        ch.Publish(env, msg);
+        publishing_ = false;
+      }
+    }
+  }
+
+  return result;
+}
+
+diagnostics_channel::Channel Permission::GetOrCreateChannel(
+    Environment* env, PermissionScope scope) const {
+  auto it = channels_.find(scope);
+  if (it != channels_.end()) {
+    return it->second;
+  }
+  const char* name = GetDiagnosticsChannelName(scope);
+  diagnostics_channel::Channel ch =
+      diagnostics_channel::Channel::Get(env, name);
+  channels_.emplace(scope, ch);
+  return ch;
+}
+
 void Permission::Apply(Environment* env,
                        const std::vector<std::string>& allow,
                        PermissionScope scope) {
diff --git a/src/permission/permission.h b/src/permission/permission.h
index f18a2ea1182c36..941a55d91129b3 100644
--- a/src/permission/permission.h
+++ b/src/permission/permission.h
@@ -13,6 +13,7 @@
 #include "permission/permission_base.h"
 #include "permission/wasi_permission.h"
 #include "permission/worker_permission.h"
+#include "node_diagnostics_channel.h"
 #include "v8.h"
 
 #include <string_view>
@@ -37,7 +38,7 @@ namespace permission {
         [[unlikely]] {                                                         \
       node::permission::Permission::ThrowAccessDenied(                         \
           env__, perm__, resource__);                                          \
-      return __VA_ARGS__;                                                      \
+      if (!env__->permission()->warning_only()) return __VA_ARGS__;            \
     }                                                                          \
   } while (0)
 
@@ -51,7 +52,7 @@ namespace permission {
         [[unlikely]] {                                                         \
       node::permission::Permission::AsyncThrowAccessDenied(                    \
           env__, (wrap), perm__, resource__);                                  \
-      return __VA_ARGS__;                                                      \
+      if (!env__->permission()->warning_only()) return __VA_ARGS__;            \
     }                                                                          \
   } while (0)
 
@@ -100,6 +101,8 @@ class Permission {
 
   FORCE_INLINE bool enabled() const { return enabled_; }
 
+  FORCE_INLINE bool warning_only() const { return warning_only_; }
+
   static PermissionScope StringToPermission(const std::string& perm);
   static const char* PermissionToString(PermissionScope perm);
   static void ThrowAccessDenied(Environment* env,
@@ -115,20 +118,22 @@ class Permission {
              const std::vector<std::string>& allow,
              PermissionScope scope);
   void EnablePermissions();
+  void EnableWarningOnly();
 
  private:
   COLD_NOINLINE bool is_scope_granted(Environment* env,
                                       const PermissionScope permission,
-                                      const std::string_view& res = "") const {
-    auto perm_node = nodes_.find(permission);
-    if (perm_node != nodes_.end()) {
-      return perm_node->second->is_granted(env, permission, res);
-    }
-    return false;
-  }
+                                      const std::string_view& res = "") const;
+
+  diagnostics_channel::Channel GetOrCreateChannel(
+      Environment* env, PermissionScope scope) const;
 
   std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
   bool enabled_;
+  bool warning_only_;
+  mutable bool publishing_ = false;
+  mutable std::unordered_map<PermissionScope, diagnostics_channel::Channel>
+      channels_;
 };
 
 v8::MaybeLocal<v8::Value> CreateAccessDeniedError(Environment* env,
diff --git a/test/cctest/test_diagnostics_channel.cc b/test/cctest/test_diagnostics_channel.cc
new file mode 100644
index 00000000000000..ea465d67ef678d
--- /dev/null
+++ b/test/cctest/test_diagnostics_channel.cc
@@ -0,0 +1,251 @@
+#include "node_diagnostics_channel.h"
+
+#include "gtest/gtest.h"
+#include "node_test_fixture.h"
+
+using node::diagnostics_channel::Channel;
+
+class DiagnosticsChannelTest : public EnvironmentTestFixture {};
+
+static v8::Local<v8::Value> RunJS(v8::Isolate* isolate, const char* code) {
+  v8::Local<v8::Context> context = isolate->GetCurrentContext();
+  v8::Local<v8::Script> script =
+      v8::Script::Compile(
+          context, v8::String::NewFromUtf8(isolate, code).ToLocalChecked())
+          .ToLocalChecked();
+  return script->Run(context).ToLocalChecked();
+}
+
+// Channel::HasSubscribers() returns false when there are no subscribers.
+TEST_F(DiagnosticsChannelTest, HasSubscribersReturnsFalseWithoutSubscribers) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  // Load the environment to initialize bindings.
+  node::LoadEnvironment(*env, "require('diagnostics_channel');");
+
+  Channel ch = Channel::Get(*env, "test:cctest:no-subscribers");
+  EXPECT_FALSE(ch.HasSubscribers());
+}
+
+// Channel::HasSubscribers() returns true after JS subscribes.
+TEST_F(DiagnosticsChannelTest, HasSubscribersReturnsTrueAfterSubscribe) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  node::LoadEnvironment(*env,
+                        "const dc = require('diagnostics_channel');"
+                        "dc.subscribe('test:cctest:with-sub', () => {});");
+
+  Channel ch = Channel::Get(*env, "test:cctest:with-sub");
+  EXPECT_TRUE(ch.HasSubscribers());
+}
+
+// Channel::Get() with the same name returns consistent subscriber state.
+TEST_F(DiagnosticsChannelTest, GetReturnsSameChannelState) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  node::LoadEnvironment(*env,
+                        "const dc = require('diagnostics_channel');"
+                        "dc.subscribe('test:cctest:same-channel', () => {});");
+
+  Channel ch1 = Channel::Get(*env, "test:cctest:same-channel");
+  Channel ch2 = Channel::Get(*env, "test:cctest:same-channel");
+  EXPECT_TRUE(ch1.HasSubscribers());
+  EXPECT_TRUE(ch2.HasSubscribers());
+}
+
+// Channel::Publish() delivers messages to JS subscribers.
+TEST_F(DiagnosticsChannelTest, PublishDeliversToJSSubscribers) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  node::LoadEnvironment(
+      *env,
+      "const dc = require('diagnostics_channel');"
+      "const assert = require('assert');"
+      "dc.subscribe('test:cctest:publish', (message, name) => {"
+      "  assert.strictEqual(name, 'test:cctest:publish');"
+      "  assert.strictEqual(message.value, 42);"
+      "  globalThis.__publishReceived = true;"
+      "});");
+
+  v8::Local<v8::Context> context = (*env)->context();
+
+  Channel ch = Channel::Get(*env, "test:cctest:publish");
+  ASSERT_TRUE(ch.HasSubscribers());
+
+  v8::Local<v8::Object> msg = v8::Object::New(isolate_);
+  msg->Set(context,
+           v8::String::NewFromUtf8Literal(isolate_, "value"),
+           v8::Integer::New(isolate_, 42))
+      .Check();
+
+  ch.Publish(*env, msg);
+
+  v8::Local<v8::Value> received =
+      context->Global()
+          ->Get(context,
+                v8::String::NewFromUtf8Literal(isolate_, "__publishReceived"))
+          .ToLocalChecked();
+  EXPECT_TRUE(received->IsTrue());
+}
+
+// C++ creates a channel first, then JS subscribes to the same name.
+// Verifies C++ Channel reflects the JS subscriber via the shared buffer.
+TEST_F(DiagnosticsChannelTest, CppChannelVisibleFromJS) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  // Expose dc on globalThis so RunJS (v8::Script) can access it.
+  node::LoadEnvironment(*env,
+                        "globalThis.__dc = require('diagnostics_channel');");
+
+  Channel ch = Channel::Get(*env, "test:cctest:cpp-first");
+  EXPECT_FALSE(ch.HasSubscribers());
+
+  // JS subscribes to the same channel name via globalThis.__dc.
+  RunJS(isolate_,
+        "globalThis.__dc.subscribe('test:cctest:cpp-first', () => {});");
+
+  EXPECT_TRUE(ch.HasSubscribers());
+
+  RunJS(isolate_,
+        "globalThis.__cppFirstMsg = null;"
+        "globalThis.__dc.subscribe('test:cctest:cpp-first', (msg) => {"
+        "  globalThis.__cppFirstMsg = msg;"
+        "});");
+
+  v8::Local<v8::Context> context = (*env)->context();
+  v8::Local<v8::Object> msg = v8::Object::New(isolate_);
+  msg->Set(context,
+           v8::String::NewFromUtf8Literal(isolate_, "from"),
+           v8::String::NewFromUtf8Literal(isolate_, "cpp"))
+      .Check();
+
+  ch.Publish(*env, msg);
+
+  v8::Local<v8::Value> received =
+      context->Global()
+          ->Get(context,
+                v8::String::NewFromUtf8Literal(isolate_, "__cppFirstMsg"))
+          .ToLocalChecked();
+  ASSERT_TRUE(received->IsObject());
+  v8::Local<v8::Value> from_val =
+      received.As<v8::Object>()
+          ->Get(context, v8::String::NewFromUtf8Literal(isolate_, "from"))
+          .ToLocalChecked();
+  v8::String::Utf8Value from_str(isolate_, from_val);
+  EXPECT_STREQ(*from_str, "cpp");
+}
+
+// JS creates a channel and subscribes, then C++ gets the same channel,
+// verifies it shares state, and publishes messages that JS receives.
+TEST_F(DiagnosticsChannelTest, JSChannelVisibleFromCpp) {
+  const v8::HandleScope handle_scope(isolate_);
+  Argv argv;
+  Env env{handle_scope, argv};
+
+  SetProcessExitHandler(*env, [&](node::Environment* env_, int exit_code) {
+    EXPECT_EQ(exit_code, 0);
+    node::Stop(*env);
+  });
+
+  node::LoadEnvironment(*env,
+                        "const dc = require('diagnostics_channel');"
+                        "globalThis.__dc = dc;"
+                        "globalThis.__jsFirstMessages = [];"
+                        "dc.subscribe('test:cctest:js-first', (msg) => {"
+                        "  globalThis.__jsFirstMessages.push(msg);"
+                        "});");
+
+  v8::Local<v8::Context> context = (*env)->context();
+
+  Channel ch = Channel::Get(*env, "test:cctest:js-first");
+  ASSERT_TRUE(ch.HasSubscribers());
+
+  // Publish from C++ — JS subscriber should receive it.
+  v8::Local<v8::Object> msg1 = v8::Object::New(isolate_);
+  msg1->Set(context,
+            v8::String::NewFromUtf8Literal(isolate_, "seq"),
+            v8::Integer::New(isolate_, 1))
+      .Check();
+  ch.Publish(*env, msg1);
+
+  v8::Local<v8::Object> msg2 = v8::Object::New(isolate_);
+  msg2->Set(context,
+            v8::String::NewFromUtf8Literal(isolate_, "seq"),
+            v8::Integer::New(isolate_, 2))
+      .Check();
+  ch.Publish(*env, msg2);
+
+  v8::Local<v8::Value> msgs_val =
+      context->Global()
+          ->Get(context,
+                v8::String::NewFromUtf8Literal(isolate_, "__jsFirstMessages"))
+          .ToLocalChecked();
+  ASSERT_TRUE(msgs_val->IsArray());
+  v8::Local<v8::Array> msgs = msgs_val.As<v8::Array>();
+  EXPECT_EQ(msgs->Length(), 2u);
+
+  // Check first message: { seq: 1 }
+  v8::Local<v8::Value> m1 = msgs->Get(context, 0).ToLocalChecked();
+  ASSERT_TRUE(m1->IsObject());
+  v8::Local<v8::Value> seq1 =
+      m1.As<v8::Object>()
+          ->Get(context, v8::String::NewFromUtf8Literal(isolate_, "seq"))
+          .ToLocalChecked();
+  EXPECT_EQ(seq1->Int32Value(context).FromJust(), 1);
+
+  // Check second message: { seq: 2 }
+  v8::Local<v8::Value> m2 = msgs->Get(context, 1).ToLocalChecked();
+  ASSERT_TRUE(m2->IsObject());
+  v8::Local<v8::Value> seq2 =
+      m2.As<v8::Object>()
+          ->Get(context, v8::String::NewFromUtf8Literal(isolate_, "seq"))
+          .ToLocalChecked();
+  EXPECT_EQ(seq2->Int32Value(context).FromJust(), 2);
+
+  RunJS(isolate_,
+        "globalThis.__jsHasSubs ="
+        "  globalThis.__dc.hasSubscribers('test:cctest:js-first');");
+
+  v8::Local<v8::Value> js_has_subs =
+      context->Global()
+          ->Get(context,
+                v8::String::NewFromUtf8Literal(isolate_, "__jsHasSubs"))
+          .ToLocalChecked();
+  EXPECT_TRUE(js_has_subs->IsTrue());
+  EXPECT_TRUE(ch.HasSubscribers());
+}
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index ae96258e95d89d..486e6e4e0e4a1d 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -105,6 +105,7 @@ expected.beforePreExec = new Set([
   'Internal Binding module_wrap',
   'NativeModule internal/modules/cjs/loader',
   'NativeModule diagnostics_channel',
+  'Internal Binding diagnostics_channel',
   'Internal Binding wasm_web_api',
   'NativeModule internal/events/abort_listener',
   'NativeModule internal/modules/typescript',
diff --git a/test/parallel/test-permission-diagnostics-channel.js b/test/parallel/test-permission-diagnostics-channel.js
new file mode 100644
index 00000000000000..add99d5f8f0970
--- /dev/null
+++ b/test/parallel/test-permission-diagnostics-channel.js
@@ -0,0 +1,29 @@
+// Flags: --permission --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('node:assert');
+const dc = require('node:diagnostics_channel');
+const fs = require('node:fs');
+
+const messages = [];
+dc.subscribe('node:permission-model:fs', (msg) => {
+  messages.push(msg);
+});
+
+// Granted permission should not publish
+fs.readFileSync(__filename);
+assert.strictEqual(messages.length, 0);
+
+// Denied permission should publish
+const hasWrite = process.permission.has('fs.write', '/tmp/test');
+assert.strictEqual(hasWrite, false);
+
+assert.ok(messages.length > 0, 'Expected at least one denied message');
+assert.strictEqual(messages[0].permission, 'FileSystemWrite');