Today we're releasing runtime authorization for AI agents, extending the Delinea platform to enforce policy on every action an agent takes before it executes across the databases, SSH hosts, Kubernetes clusters, cloud consoles and MCP servers agents actually reach.
We built it because most of the industry is solving the wrong problem
I've had this same conversation with four or five customers in the last month, and I keep landing in the same place: Most organizations are trying to solve AI agent security by finding every agent. But that’s an impossible task.
Here's why: Gartner projects 10 to 100 times more AI agents than human users in enterprise environments within three years. That 33% of enterprise software will embed agentic AI by 2028. Agents spin up in seconds, inherit credentials nobody issued and spawn even more agents. Try to build a complete inventory of that population and there will be gaps before you even finish. You're chasing a rabbit that keeps multiplying into more rabbits.
It’s creating real problems, too. Our own research found that 90% of organizations say they feel pressure to loosen access controls just to keep AI initiatives moving, and more than a third say identity friction has already delayed a project. That's the false choice most security teams are facing right now: Slow AI down to inventory everything or loosen controls and hope. Neither is a strategy.
The identity security gap nobody's watching
Most identity security runs on two moments. Authentication happens once, at the start of a session, and confirms who or what is asking to get in. Governance runs on a schedule: periodic reviews, approval queues. Neither one is watching while the agent is actually working. That gap between login and the next scheduled review is where the damage happens.
I've seen this play out directly. A global communications company running 440 AI agents against 100 human users had an overprivileged agent inherit full credentials, no scoping, and delete a database. Nobody could tell whether a person or the agent had triggered it. Not because nobody was looking for agents, but because nobody was watching what it did once it was already inside.
We’ve also seen a public version of the same gap. In July, Hugging Face disclosed it had been breached by an autonomous AI agent that escaped its sandboxed test environment through a previously unknown vulnerability. The agent then broke into Hugging Face’s production systems after it escalated its own privileges to obtain information it thought it needed. The access it used was never scoped for that purpose.
That’s the exact gap runtime authorization closes, enforcing what an agent can reach at the moment it acts, not just at the moment it connects.
Control what matters, not everything that moves
Don’t try to find every agent before you decide what to govern. Decide what you're protecting first: The databases, the Salesforce instance, the deployment pipeline, the financial systems or the customer records. Put controls at the point where anything, human or agent, tries to reach those things, and set your policy there.
The visibility you tried to build by chasing every identity shows up anyway, the moment something tries to touch what you’re protecting. You end up knowing exactly which agents are hitting your critical systems, in real time, without ever having counted them first. You end up building an inventory of the agents that matter, not every single experiment.
How runtime authorization puts control into practice
That's the thinking behind what we shipped today. Credentials scoped to the right level of privilege are injected just-in-time, scoped to the task and disappear the moment the task ends. There's no standing credential left behind and no inventory to maintain, because we're not trying to track every agent. We're controlling allowed actions against what you've already decided to protect, creating a recording for audit purposes and helping to define ownership and accountability
We're controlling every action against what you've already decided to protect
The security industry spent years solving credential theft. AI agents introduced a different problem: authorized access doing unauthorized things. You can have perfect credential hygiene and still watch an agent tear through your production environment in milliseconds. Enforcing policy on the action as it runs is what stops that. Recording it after the fact, or revoking access later, just documents what already happened.
The AI authorization question worth asking
Ask yourself the question I ask every customer I talk to: Do you know what your AI agents are doing to your most critical systems right now?
If one acted outside its bounds today, could you tell whether a person or an agent was behind it, and how long would it take you to find out? If the answer isn't immediate, the fix isn’t a longer inventory list. It’s control at the moment access is needed.