Give each agent its own identity, authority to act, and access to resources under your policy.
Your agent wants a credential to access resources
Your agent gets just-in-time, scoped access
Runtime auth
“We wanted our engineers deploying agents and tools into production without needing to be security or identity experts. Keycard’s platform made that possible. We had agents running against production systems in days.”
The Challenge
Agents accumulate privilege, and most teams have no way to narrow it back down.
Put a human in front of every action?
Manual approvals don’t scale.
Let an agent inherit a human or workload identity?
There’s no way to tell who took what action.
Provision for everything it might need?
That’s also everything it could do.
Keycard verifies each request, evaluates it against policy, and makes authorization decisions for your agents and whatever they need to access.
Keycard verifies the agent making the request and where it’s running.
When it acts for a user, the request also carries that user’s identity. The full picture is used to make authorization decisions at runtime.
Connect a resource once and make it available to whoever needs it.
Resources can be data stores, MCP servers, APIs, or agents. Configure the resource’s credential provider and Keycard will handle all authorization requests against it.
Custom resource Knowledge MCP
API GitHub API
MCP server PagerDuty MCP
MCP server Sentry MCP
MCP server Neon MCP
MCP server Linear MCP
API Slack API
At runtime, each request is evaluated against policy.
If approved, Keycard’s secure token server issues a short-lived authorization token scoped to the task at hand.
If denied, no credentials are created but the decision is logged for visibility.
knowledge:read knowledge:read access to Knowledge MCP Inspect sessions by application, user, or resource and export audit logs to your SIEM.
Each authorization event includes full attribution, including denials. Revoke a credential instantly and subsequent events are denied wherever it applies.
Research agent
repo channels:read knowledge:read Policy denied the credential request.
Alex Lee doesn’t have PII access, so neither does this agent. Rule: agents-inherit-user-scope
pii-db context.subject in Group pii-access No agent or user gets PII Database unless the request is on behalf of someone in pii-access.
@id("agents-inherit-user-scope")forbid ( principal, action, resource == Keycard::Resource::"pii-db") unless { // the user this agent acts for context has subject && context.subject in Keycard::Group::"pii-access"};Policy as Code
Define access in Cedar and manage changes using Terraform. Validate and test new policies, then activate the version you want Keycard to use for credential requests.
Policy enforcement points
Use the request path you already have. Choose where authorization should happen to protect the resources your agents use.
01 / Application
Add authentication, authorization, and delegated API access to any agent or MCP server with a few lines of code.
Keycard handles everything—no token plumbing, no auth middleware, no security footguns.
02 / Gateway
A gateway brokers authentication and authorization across agents, clients, and resources.
Each request gets secure, policy-checked access from Keycard with no code changes.
03 / Infrastructure
A sidecar proxy intercepts the agent’s outbound traffic and swaps placeholder secrets for real, user-scoped tokens from Keycard.
The agent stays unchanged and never holds a real credential.
Enterprise Ready
Keycard speaks the protocols your stack already uses, ships drop-in SDKs for the services you build, and federates the identity providers you run today. Policy is written in Cedar and applied through Terraform, the same way you manage the rest of your infrastructure.
White Paper
A shared framework for deploying enterprise AI agents, developed in partnership with Docker and Snyk. Six outcomes and the capabilities, implementation requirements, and evidence associated with each one. Bring it to your next security review to evaluate your agentic security posture.
Developed with Snyk, Docker and Keycard
Read Agent Baseline (opens in a new tab)On the record
Conversations about building and securing AI agents from our podcast, Insecure Agents.
“What is this actual thing? Is it a person? Is it a bot? Is it somewhere in between? Is it a bot on behalf of me? … We’re going to want to get that right for logs. We’re also going to want to get that right for the authorization of what it can do. A lot of systems we’re dealing with just were not built that way — you have not enough granularity in the AuthZ model itself.”
Travis McPeak
Security Lead, Cursor
“We want our ecosystem to be a place where there’s zero standing credentials. We ironically call it the death of long-lived credentials. They have to go away.”
Malte Ubl
CTO, Vercel
“You cannot treat an agent or any part of AI as you would treat a person… When you think about granting authority just in time, it means something completely different from an AI perspective.”
Alissa Abdullah
Deputy Chief Security Officer, Mastercard
“We need to start looking at cybersecurity, especially within AI security, about the actions — not just the permissions, or what I am entitled to do, but actually what is the action that it’s done, what actions has it already done?”
Michael Davis
Global Chief Security Architect, J.P. Morgan
More about Keycard
Keycard is runtime authorization infrastructure for AI agents. It gives applications their own identity, evaluates credential requests against policy, and issues credentials when access is allowed. Register applications and resources once, then reuse them as you build.
Developers building agents and internal tools, alongside platform, security, and AI operations teams bringing them into production. Use Keycard with your agents, MCP servers, APIs, and other services.
When agents need to act on production systems at scale. If you’re managing dozens of MCP servers, using multiple human and workload identity providers, or considering refactoring existing applications one-by-one, that’s a sign you need Keycard.
Keycard federates the identity provider you already run, whether that’s Okta, Entra, Google, or Auth0, and adds policy and token issuance on top rather than replacing it. SDKs for Python, TypeScript, Ruby, and Go cover services your developers build. Policy is defined in Cedar and ships as code through Terraform. Supported audit events export to your Amazon S3 bucket for ingestion by compatible SIEM tools. If you already run an AI gateway, talk to us about how it can act as the enforcement point for authorization decisions.
Runtime authorization for AI agents means the access decision is made when the agent acts, not when access was set up or when the agent was deployed. Each request carries context on which agent is asking, where it’s running, who it’s acting for, and what it wants to reach. Policy is evaluated against the full composite identity, and if approved, a credential is issued for the approved access.
The alternatives are to let the agent inherit a human identity or a shared service account with standing permissions; to pre-authorize the agent with its own fixed set of permissions, sized in advance to cover everything it might need; or to gate progressive privilege by human-in-the-loop approvals. Each gives something up. Inherited access is sized to someone else’s job and attributed to them rather than to the agent. A pre-authorized grant is written before anyone knows what the agent will do, so it covers everything it might do. Approvals fit a small set of sensitive operations, but they don’t scale to every request.
Most solutions inspect traffic after a credential already exists. Keycard evaluates each request against policy and issues credentials only if access is approved. If the request is denied, Keycard issues no new credential. Keycard records policy decisions and credential requests in audit logs. Keycard mints the tokens, but your traffic doesn’t have to go through it. With the SDK in your app or a proxy in your infrastructure, your agent talks to the resource directly. Calls pass through Keycard only if you route them through its gateway, which is optional.
Sign up with your work email to request a Keycard account.
Tell us about your use case and we'll follow up with a custom proposal.
