Privileged access management for AI agents
Control what agents can do for each user or customer, with rules that are easy to write and test. Keys never reach the agent, every call is authorized and audited, and risky calls wait for approval.
- IdentityOwn key, scoped to Stripe3 ms
- GrantActing for finance-ops4 ms
- Policy“Refunds over $200 need approval”Hold
- ApprovalApproved by J. Lee1m 42s
- CredentialKey injected, agent never sees it1 ms
- StripePOST /v1/refunds → 200212 ms
- AuditLogged and streamed to SIEM1 ms
Trusted by
Put your first agent behind Alter in 10 minutes.
The free plan includes 10,000 API calls a month and unlimited users, agents and apps. Sign up, mint a key, and make your first governed call.
Install the SDK
- Python
$ pip install alter-sdk - TypeScript
$ npm install @alter-ai/alter-sdk
Or let your coding agent set it up
$ claude mcp add --transport http alter-onboarding \ https://mcp.alterauth.com/mcpThe Alter Docs MCP server walks your agent through the CLI, the SDK and each verification step.
Give agents their own keys, not yours.
Without Alter
Keys scattered everywhere
Pasted into prompts, configs, and .env files across every repo.
One key does everything
Every agent borrows the same over-scoped credential.
No answers afterward
Nobody can say which agent did what, or on whose behalf.
With Alter
One vault
Stored once and injected per request, so proxied calls keep it out of your code.
Least privilege per agent
Each agent gets its own identity and scopes, with a human gate where you want one.
Every action on the record
A tamper-evident trail with a name attached to every call.
One control point between your agents and every API they call.
Alter sits in the request path. It checks who the agent is, whose data it is touching and what your policy allows, then injects the credential and records the outcome.
- 01
Decide what each agent may do
- Policy to the parameter
Deny by default. Narrow by method, endpoint, amount or field, at org, app, agent or grant level.
Policy engine › - Per-agent identity
Each agent gets its own key and scopes, so every call traces to that agent, and to the person it acts for when it acts for one.
Agent identity › - Credentials stay in the vault
With proxied calls, Alter injects the OAuth token or API key on its side, so the agent never holds it. Delegated, restricted and approval-gated grants are proxy-only.
Credential vault ›
All runtime policies
Every custom runtime policy in this app, across all levels. Select a row to inspect its full definition and target.
Support Bot only emails customers
Agent runtime policy · Support Bot
Level
Agent
Target
Support Bot · support-bot
Applies to
Requests from this agent
Provider
Gmail · OAuth
Matching requests are refused before the provider is called.
Request conditions (all must match)
- Operation
- gmail.users.messages.send
- HTTP method
- POST
- Endpoint
- /gmail/v1/users/me/messages/send
- Parameter
- to does not end with @acme.example
- Effect
- Deny
- Message
- "Support Bot may only email acme.example addresses."
Explain a request
- 02
Hold risky calls for a person
- Human approval
Risky calls wait for a named person, who sees the exact request before it runs.
Approvals › - End users stay in control
People see and revoke what each agent can do with their accounts, from their own wallet.
Wallet › - Instant revocation
Revoke an agent, key or grant and the next request fails. IdP offboarding cascades.
PAM for AI agents ›
Pending approvals
POST api.stripe.com/v1/refunds
Expires Oct 29, 2:03 PMRefund duplicate annual charge for Initech (ticket #4907)
Provider: stripe · billing-agent
No approvals are waiting on you.
Recent decisions
Back to approvals
Acme Assist asked to do something that needs your OK. Nothing happens unless you approve.
Approval request
PendingExpires 10/29/2026, 2:03:05 PM
What the agent wants to do
POST api.stripe.com/v1/refunds
Provider
stripe
Grant type
Managed Secret
Grant label
billing-agent
Request values
- body.charge
- "ch_3Pf8a1b2c3d4e5f6a7b8c9d0"
- body.amount
- 24000
- body.reason
- "requested_by_customer"
- body.metadata.account
- "Initech"
Reason given
Refund duplicate annual charge for Initech (ticket #4907)
Approve this request?
The agent will be able to execute the request below.
POST api.stripe.com/v1/refunds
Request values
- body.charge
- "ch_3Pf8a1b2c3d4e5f6a7b8c9d0"
- body.amount
- 24000
- body.reason
- "requested_by_customer"
- body.metadata.account
- "Initech"
This action is recorded in the audit log with your identity.
Reason (optional)
- 03
Keep a record of every call
- Audit trail
Every call has a row: which agent, on whose behalf when it acts for someone, which endpoint, which policy decided it.
Compliance & audit › - SIEM and OTEL export
Stream the same record to Splunk, Datadog or your own collector.
See exports › - Evidence on request
Export a filtered trail for a customer's security review.
The security review ›
Audit Logs
Audit trails for Acme Assist
Audit Log Details
Complete audit trail for this event
Action
Approval executed
approval.executed · Write
Timestamp
Oct 28, 2026, 2:03:05 PM
Reason
Verified double charge in Stripe.
Caller (API key)
Billing Agent · billing-agent
billing-agent-initial (alter_key_…7f2c)
Granted to
finance-ops
Group · via Okta
Approval decision
- Requested Action
- POST api.stripe.com/v1/refunds
- Lifecycle Event
- approval.executed
- Approver
- maria.lopez@acme.example
- Step-Up Auth
- Not required
- Executed Status Code
- 200
- Executed Latency
- 212ms
- Approval Request ID
- 40da4d27-6ed3-4d36-b7dc-325d6521d9ed
Runtime policy evaluation
- Decision
- Approval required
- Reason
- Refunds need approval
- Rule ID
- require_approval
Request context
- Trace ID
- 7f3ae91c5feb1c9b1988e6a9ea475bf9
- Grant ID
- f2e1c2e6***
Streamed to Splunk
Agents get scoped access. Proxied calls never hand them the key.
One SDK call handles storage, refresh, policy, and audit for 140+ providers. First-class LangChain, MCP, and AWS integrations.
Read the quickstartimport osfrom alter_sdk import App, HttpMethod, PendingApproval async with App(api_key=os.environ["ALTER_API_KEY"]) as app: # Token resolved, injected, and audited automatically response = await app.proxy_request( HttpMethod.GET, "https://api.github.com/user/repos", grant_id=os.environ["GITHUB_GRANT_ID"], query_params={"sort": "updated", "per_page": 5}, ) if isinstance(response, PendingApproval): response = await app.await_approval(response.approval_id) repos = response.body_json()Per-agent identity
Each agent has its own key and scopes, traceable to a person.
No secrets in code
Tokens live in a dedicated vault, and proxied calls inject them on Alter's side.
Fail closed
If a policy cannot be evaluated, the request is denied.
Building agents
Pass your customers' security review
- Per-agent identity and scoped grants instead of one shared key
- Policy and human approval a customer's security team can inspect
- An audit trail you can hand to a reviewer, streamed to their SIEM
Securing agents
PAM controls for a new kind of privileged user
- See every call an agent makes through Alter: which agent, whose access, which policy, who approved
- Default-deny policy down to the parameter, and approval for risky calls
- Revoke an agent, key or grant instantly; IdP webhooks cascade offboarding
OAuth providers and API-key services, ready to govern.
Every provider ships with a catalog of its operations, so you write policy against what the API actually does. LangChain, MCP and AWS SDK integrations included.
View all integrations ›What teams build on Alter
By situation
Agents across client accounts
Firms running AI agents for many clients use Alter to give each agent one client's access, hold every write for approval, and keep a record per client.
OpenClawOpenClaw in production
Run one OpenClaw for your team or clients. An open-source plugin gives each person their own accounts and approvals. No account tokens on the gateway.
For software companiesAI agents in your customers' accounts
Let your product's agents act in each customer's accounts. Alter runs OAuth, scopes every call to one customer, and lets customers approve risky actions.
Guides
Every card is a working guide with code.
Call APIs on behalf of users (opens the guide in a new tab)
Run OAuth, Connect, and identity-aware token retrieval end to end.
Give an AI agent scoped access (opens the guide in a new tab)
The agent gets its own identity, its user grants, and its own audit trail.
Provision secrets for backend services (opens the guide in a new tab)
Store API keys and service tokens in Alter instead of environment variables.
Expose credentials to Claude Code (opens the guide in a new tab)
Build your own MCP server that serves Alter-managed credentials as tools.
Partition agent memory by identity (opens the guide in a new tab)
Key memory, sessions, and channels by verified identity, never by what the LLM claims.
Build a multi-user server (opens the guide in a new tab)
Serve many users from one service without the credential entering your process.
A platform you can trust
- Credentials live in a dedicated secret store, encrypted at rest, with keys managed outside the application database
- Fail-closed authorization: if a policy cannot be evaluated, the request is denied
- Zero-trust ownership: a key confers no capability without an explicit record naming it
- Postgres holds metadata and vault references; provider tokens and credentials live only in the vault
- Per-key isolation, plaintext credentials never in logs, and proxy-only keys that cannot retrieve a credential at all
Controls monitored continuously
SOC 2 in progressOur trust center publishes the live state of our security program: monitored controls, an independent penetration test within the last 12 months, and security policy documents on request.
Visit the trust center (opens in a new tab)Built by engineers who ran platform infrastructure at scale.
Alter Labs is based in New York and backed by Y Combinator. You talk to the founders from the first call.
About the company ›
Srikar Dandamuraju
Co-Founder & CEO
Previously led platform engineering at Goldman Sachs, scaling core infrastructure for its asset management business and the launch of the GM Card.
Kevan Dodhia
Co-Founder & CTO
Previously technical co-founder of Compute.ai, a high-performance compute platform for regulated enterprises, acquired by Terizza in 2025.
Put your agents under privileged access control.
Book a 30-minute walkthrough with the founders.