Alter launches access control for AI agents: vault, policy, audit

Alter presents itself as privileged access management for AI agents. Its landing page, the source for this account, says the product lets teams control what agents can do on behalf of each user: enforce policy, keep credentials private and audit every action. The submission title frames it as a Launch HN from a YC S25 company.

The pitch starts from a problem. Without Alter, the page says, keys are pasted into prompts, configs and .env files across every repo; one over-scoped credential is shared by every agent; and afterward nobody can say which agent did what, or on whose behalf. With Alter, credentials are stored once in a vault and injected per request, so proxied calls keep them out of the customer's code. Each agent gets its own identity and scopes, with a human approval gate where the customer wants one. Every action goes on the record in a tamper-evident trail with a name attached to every call.

The page describes four features on a single request path. The Credential Vault stores credentials once, and agents use them without ever seeing them. The Policy Engine checks each request against the customer's rules and denies by default. Agent Identity gives per-agent keys and scopes, traceable to a real person. Human in the loop means sensitive calls wait for a named person while everything else flows. A compliance and audit layer produces a record that can be handed to an auditor and streamed to the customer's SIEM.

There are two audiences. For teams building agents, Alter promises help passing their customers' security reviews: per-agent identity and scoped grants instead of one shared key, policy and human approval that a customer's security team can inspect, and an audit trail to hand a reviewer. For teams securing agents, it offers PAM-style controls for what the page calls a new kind of privileged user: visibility into every call an agent makes through Alter (which agent, whose access, which policy, who approved), default-deny policy down to the parameter with approval for risky calls, and instant revocation of an agent, key or grant, with IdP webhooks cascading offboarding.

Integration is through an SDK. By the vendor's own claim, one SDK call handles storage, refresh, policy and audit for 140 providers, and LangChain, MCP and AWS integrations are described as first-class. The page lists six guides, each described as a working guide with code: calling APIs on behalf of users (OAuth, Connect and identity-aware token retrieval), giving an AI agent scoped access, provisioning secrets for backend services instead of environment variables, exposing credentials to Claude Code through a custom MCP server that serves Alter-managed credentials as tools, partitioning agent memory by verified identity rather than by what the LLM claims, and building a multi-user server where the credential never enters the customer's process.

On its own security, the page says credentials live in a dedicated secret store, encrypted at rest, with keys managed outside the application database. Authorization is fail-closed: if a policy cannot be evaluated, the request is denied. Ownership is zero-trust: a key confers no capability without an explicit record naming it. Postgres holds only metadata and vault references, while provider tokens and credentials live only in the vault. The page also claims per-key isolation, no plaintext credentials in logs, and proxy-only keys that cannot retrieve a credential at all. SOC 2 is marked as in progress. The trust center is said to publish monitored controls, an independent penetration test within the last 12 months, and security policy documents on request. The call to action is a 30-minute walkthrough with the founders.

Key facts

• Alter sells privileged access management for AI agents: a credential vault, policy engine, per-agent identity, human approval and audit trail on a single request path.
• Credentials are stored once and injected per request, so proxied calls keep them out of customer code; proxy-only keys cannot retrieve a credential at all.
• Policy is default-deny down to the parameter, with approval for risky calls and instant revocation of an agent, key or grant.
• By the vendor's own claim, one SDK call covers storage, refresh, policy and audit for 140 providers, with LangChain, MCP and AWS integrations.
• SOC 2 is listed as in progress; the trust center is said to publish an independent penetration test within the last 12 months.

Why it matters

Agents that act for many users need credentials, and the page describes the common shortcut: keys pasted into prompts, configs and .env files, or one over-scoped credential shared by every agent. Alter's argument is that agents are a new kind of privileged user and deserve the controls that privileged accounts get: separate identity, least privilege, approval for risky actions and a record of who did what. Putting the vault, policy and audit on one request path is the product's central design claim.

Who it affects

The page names two groups. Teams building agents are told Alter helps them pass their customers' security reviews, with per-agent identity, inspectable policy and an audit trail that can go to a reviewer's SIEM. Teams securing agents get visibility into every call, default-deny policy and instant revocation, including offboarding cascaded through IdP webhooks.

How to use it

Integration goes through an SDK, with first-class LangChain, MCP and AWS integrations. The page links six guides with code, covering calls on behalf of users, scoped access for an agent, secrets for backend services, exposing credentials to Claude Code through a custom MCP server, identity-keyed agent memory and multi-user servers. The page offers a 30-minute walkthrough with the founders. No pricing is given.

How solid is it

Everything here comes from the vendor's own landing page, so these are claims, not tested results. The figure of 140 providers is the vendor's own claim; no independent benchmark, latency figure or adoption number is given. SOC 2 is described as in progress, with no completion date. The trust center is said to publish an independent penetration test from the last 12 months, but the page does not say who performed it or publish its results. The page does not mention Y Combinator, the S25 batch or Hacker News; those come only from the submission title.

Risks and caveats

The page gives no founder names, team size, funding, customers or pricing, and no launch date. It does not say whether Alter is open source or self-hostable. Routing every agent call through one proxy-style request path concentrates credentials and policy in a single product, so a buyer would want to read the trust center and the pen test before relying on it. The fail-closed design means a policy that cannot be evaluated blocks the request.

“Give agents their own keys, not yours.”

— Alter landing page