Agentic Access Management
Stop handing AI agents standing keys to production.
Cipherlatch issues each agent a scoped, short-lived credential per request — and revokes it in one call. Your keys never leave your custody. A latch, not a key.
Sits in front as a gateway — OAuth token-exchange, MCP, SPIFFE — with no changes to your agent code.
The exposure
Every agent you deploy is an identity you can't see, scope, or shut off.
Agents authenticate with the credentials a human handed them: a long-lived API key, a service-account secret, an OAuth refresh token. Multiply that across every tool an agent touches and you've built an access surface no one owns and no audit can reconstruct.
Standing secrets, unbounded blast radius
A leaked agent key is valid until someone notices and rotates it by hand. Until then it carries every permission the agent was ever granted.
No least privilege
Agents inherit broad, static roles because scoping each call is impractical. One prompt-injected agent reaches everything the credential can.
Nothing to hand the auditor
Which agent used which credential, against which resource, when? Without a broker in the path, the answer is reconstructed from partial logs — or not at all.
The broker in the path
Put Cipherlatch between the agent and the resource. Nothing standing ever leaves.
Agents don't hold credentials — they ask Cipherlatch for access at the moment of use. The broker mints a short-lived, cryptographically bound token scoped to that request, records it, and can kill it instantly.
Agent requests access
The agent presents its own workload identity — no shared secret. Cipherlatch authenticates it against your IdP or a SPIFFE/OIDC federation trust.
Broker issues scoped, short-lived credentials
Policy decides what's allowed, then Cipherlatch mints a sender-constrained token bound to the caller and scoped to the resource. It expires in minutes.
Revoke and prove it
Kill a credential, an agent, or a tenant in one call — the blast radius closes immediately. Every issue, deny, and revoke lands in a tamper-evident log.
Agent-native
Your agent discovers what it may do — and still can't exceed it.
Point any MCP-speaking agent at the broker. It lists the routes it holds a grant on as tools, calls them, and never sees a credential. No per-agent integration code, no recipe to copy around.
One URL, no out-of-band setup
An unauthenticated request answers with a standards-compliant challenge (RFC 9728) that names this broker as its own authorization server. A compliant client bootstraps from that alone.
The same enforcement, a second door
A tool call runs the identical path as a gateway request — grant, method and path policy, rate limits, contextual policy, server-side credential injection, audit. The model chooses the tool; the broker still decides.
Free in the AGPL core. A protocol front door is how agents find you — charging admission to the on-ramp would defeat the point.
What you control
The governance surface a security review actually asks about.
Cipherlatch maps to the controls you already have to answer for — least privilege, key custody, provisioning, separation of duties, and evidence.
Instant revocation
Revoke a single credential, a whole agent, or an entire tenant in one call. No waiting on token expiry, no manual key rotation.
Key custody, on your terms
Per-tenant keyrings backed by cloud KMS or HSM. Keys are generated, wrapped, and rotated inside a boundary you own — agents never see them.
Federated workload identity
Trust agents by who they are, not by a shared secret. SPIFFE and OIDC federation let workloads across clusters and clouds authenticate directly.
Policy at the gateway
Every request passes an OPA or Cedar decision before a credential is minted. Rate limits and quotas cap what a compromised agent can do.
Lifecycle provisioning
SCIM 2.0 syncs agents and owners from your directory, with owner-suspension that cascades to every credential the owner controls.
Evidence, by default
Every issue, deny, and revoke is recorded with the caller, the scope, and the policy decision. Records are hash-chained and anchored by signed checkpoints, so modification, deletion and reordering are detectable — by you, or by a tenant checking their own slice without trusting you.
Open core
Run the whole broker for free. Pay only to root your keys in your own hardware.
Cipherlatch is self-hosted — your keys never leave your boundary, and we're never in a position to hold them. The commercial line isn't a paywall around SSO or basic auth; it's the HSM and per-tenant KMS backends that let you keep custody in hardware you control, at enterprise grade.
Core
The full broker, self-hosted. No feature gates on the things every team needs.
- Short-lived credential issuance
- DPoP + private_key_jwt binding
- Instant revocation + tamper-evident audit
- SPIFFE / OIDC federation, SCIM 2.0
- Gateway policy, rate limits + quotas
- MCP server — agents discover their own tools
- FIPS-mode crypto — boot-fails if OpenSSL isn't
- Keystores: PEM, Vault, Java KeyStore
- Single sign-on — never a paid add-on
Enterprise
Root your keys in your own HSM and per-tenant KMS — custody-grade backends over the same core.
- HSM-backed custody, in your hardware
- Per-tenant cloud-KMS keystores
- Audit checkpoints signed in your HSM
- Priority support + SLA
No SSO tax. No audit-log tax. You pay to keep custody in your own hardware — never to hand it to us.
Agentic Access Management
Give every agent exactly the access it needs — for exactly as long as it needs it.
Deploy the open-source broker today, or talk to us about custody-grade key handling in hardware you control.