AI access control at the moment an agent acts
Evaluate every consequential AI-agent action against identity, delegated authority, resource context and policy before it reaches the target system.
The problem
What this is actually about
An agent can authenticate correctly and still attempt an action it should not take. Authentication proves which credential arrived; it does not prove who delegated the task, whether the resource is in scope, or whether the action is reversible.
Static grants are especially dangerous for agents because the hardest possible task becomes permanent authority. Runtime authorization evaluates the proposed action with current context, narrows delegated authority, and sends only the exceptional decision to a person.
What the platform does about it
Read from the product architecture rather than written here, so this page cannot promise something no module ships.
Who owns each agent, and can it prove what it is?
- A stable agent identity that does not change when the model, infrastructure, credential or deployment does
- Business, technical and security ownership, with an orphaned-agent warning when nobody holds it
- A declared purpose that later becomes part of the authorization decision
- Machine authentication by workload identity, mutual TLS, signed JWT and short-lived tokens rather than permanent keys
- A lifecycle from discovery through review, approval, production, recertification and retirement
What is this agent allowed to reach?
- Role and attribute rules evaluated with agent, user, tenant, data, tool, environment, time, risk and declared purpose in context
- Action-level permissions, so reading a supplier and changing its bank details are separate grants
- Five sensitive action classes from read through draft, reversible execution, human approval and dual approval
- Just-in-time privileges that are issued for one action and expire rather than accumulating
- A credential broker that issues scoped, short-lived secrets on request, so an agent never holds a permanent key
Under which rule was this decided?
- Rules authored in natural language, compiled to structured policy, and verified by a human before activation
- Conditions over agent, owner, department, tool, action, resource, data class, geography, environment, time, risk, user, transaction value and tenant
- Simulation against historical traffic, so a rule states what it would have blocked before it blocks anything
- Versioned policy, with every decision recording the version that produced it
What is it doing right now, and should this action be allowed?
- A gateway between the agent and the tool, API or database it is calling
- A recorded decision per action, carrying agent, user, resource, context, risk, policy version and outcome
- Behavioural baselines, so a hundredfold jump in record reads reads as an anomaly rather than a busy afternoon
- Runaway protection that suspends an agent stuck in a loop before it exhausts cost or capacity
- Human approval for sensitive actions, and two-person approval for critical ones
What it leaves behind
The artefacts these modules produce. Evidence generated by a decision, rather than assembled for an audit afterwards.
- An owner of record for every production agent
- A purpose declaration an out-of-scope action can be measured against
- A permission inventory showing where an agent exceeds its purpose
- An expiry on every elevated grant
- A credential ledger: which agent held what, against which system, and when it lapsed
- A simulated impact figure before activation
- A policy version stamped on every decision
- An allow, deny or escalate decision on every governed action
- A suspension when behaviour leaves the baseline
See it working
Every claim above has somewhere on this site you can go and check it.
- See a runtime decision
Watch deterministic policy refuse an unsafe action and hold a high-value action for approval.
- Inspect delegated authority
See why delegated authority can narrow but must never widen.
- Review the access module
Inspect the shipped authorization capabilities and outputs.
Common questions
- What is AI access control?
- It is authorization for an agent action using the agent, initiating principal, resource, requested operation, delegated scope and current risk context—not only the credential presented downstream.
- How does human approval fit?
- Policy resolves ordinary allow and deny decisions automatically. A human receives only a bounded exceptional decision with the action, impact and evidence needed to approve or refuse it.
- Can it work with ABAC or ReBAC?
- Yes. Attributes and relationships are inputs to the decision. The platform adds agent purpose, delegation, reversibility and runtime context to those existing authorization models.