Akeyless ships Runtime Authority, authorising AI agents per action instead of per session
Agents hold no secrets and get no standing privilege. Every action is authorised at the moment it happens, and the audit trail links the originating prompt to the policy decision and the executed command.
Akeyless has launched Runtime Authority for AI agents, an intent-aware authorisation layer that decides at the moment of action rather than at the start of a session. Access adapts per request, policy is evaluated in real time, and unsafe actions are blocked as they are attempted. The design is secretless: agents never hold API keys, passwords, or tokens, and have no direct connectivity to target systems, with zero standing privileges and just-in-time grants across cloud services and on-premises applications, databases, and infrastructure. Sessions are continuously monitored and revocable, and every action ties back to the prompt that triggered it. Chief executive Oded Hareven framed it as control rather than visibility.
Why it matters
The identity industry spent 2026 agreeing that agents need identities. The harder question is granularity. Authenticating an agent once and handing it a session is the OAuth model, and it fails badly here because a compromised or confused agent does thousands of things per session that no human would.
Per-action authorisation is the right unit, and Akeyless is not alone in that view: P0 Security, C1, and Saviynt's Zuma make versions of the same argument. The differentiator worth testing is the prompt-to-action audit chain, because in an incident the question auditors ask is which instruction caused which command, and almost nothing answers it today.
Cost is latency on every call and a new hard dependency in the execution path. Model that before rollout. See secrets management and securing AI agent identities.
Source: Akeyless
Related on Start with Identity
- BlogC1 ships enterprise-managed authorization, putting SSO in front of MCP agents
The identity platform formerly called ConductorOne now issues short-lived scoped tokens for MCP servers under the open enterprise-managed authorization extensio
- BlogIBM makes Agent Identity and HashiCorp Vault 2.2 generally available to govern AI agents
At TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle
- BlogInfisical raises a $40 million Series B to build secrets and credential access for AI agents
Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in se
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- Comparisonakeyless-vs-hashicorp-vault
Vault scores 4.4 to Akeyless's 4.3. Vault is the broadest platform if you can run it and accept BUSL under IBM; Akeyless is the managed alternative with a Vault