Alter（YC S25）发布多用户智能体访问控制产品 Alter Vault
Launch HN: Alter (YC S25) – Access control for multi-user agents
Alter（YC S25）在 Hacker News 发布 Alter Vault，为多用户智能体提供访问控制，通过一次 SDK 调用完成认证、授权和日志记录，覆盖 140 个集成。平台为每个智能体分配独立身份和受限授权，支持按参数默认拒绝策略、高风险调用人工审批、即时吊销密钥或授权，并提供可交给审查方的审计日志。官方称凭据存放在独立加密密钥库中，授权失败即拒绝请求，SOC 2 认证仍在进行中。
Alter Vault | Authorization Enginegnt_7x92k
Incoming Request
A
sales-agent
agent: ai_agent
GET api.github.com/user/repos
Policy Evaluation
✓Identity verified
✓Scope check: repo:read
✓Rate limit: 847 / 1,000
✓Token refreshed (3m ago)
Authorization Result
APPROVED
Injected Headers
Authorization: Bearer ghp_••••••••k4m2
X-Alter-Grant: gnt_7x92k
Audit Log
action: token.proxy
agent: sales-agent
target: github.com
status: 200 OK
latency: 142ms
140 integrations
In-path enforcement
SOC 2 in progress
Give agents their own keys, not yours.
Without Alter
.envOPENAI_API_KEYsystem-prompt.mdSLACK_BOT_TOKENci-config.yamlSTRIPE_SECRET_KEY
Keys scattered everywhere
Pasted into prompts, configs, and .env files across every repo.
admin-key-prodused by: all 14 agents
One key does everything
Every agent borrows the same over-scoped credential.
Who refunded that charge?No results found.
No answers afterward
Nobody can say which agent did what, or on whose behalf.
Building agents
Pass your customers' security review
- Per-agent identity and scoped grants instead of one shared key
- Policy and human approval a customer's security team can inspect
- An audit trail you can hand to a reviewer, streamed to their SIEM
Securing agents
PAM controls for a new kind of privileged user
- See every call an agent makes through Alter: which agent, whose access, which policy, who approved
- Default-deny policy down to the parameter, and approval for risky calls
- Revoke an agent, key or grant instantly; IdP webhooks cascade offboarding
How it works
Alter authenticates, authorizes, and logs every request
One SDK call handles storage, refresh, policy, and audit for 140 providers. First-class LangChain, MCP, and AWS integrations.
Platform
One platform between your agents and every API
Four features on a single request path.
Use cases
What teams build on Alter
Every card is a working guide with code.
How the platform itself is secured
- Credentials live in a dedicated secret store, encrypted at rest, with keys managed outside the application database
- Fail-closed authorization: if a policy cannot be evaluated, the request is denied
- Zero-trust ownership: a key confers no capability without an explicit record naming it
- Postgres holds metadata and vault references; provider tokens and credentials live only in the vault
- Per-key isolation, plaintext credentials never in logs, and proxy-only keys that cannot retrieve a credential at all
Controls monitored continuously
SOC 2 in progress
Our trust center publishes the live state of our security program: monitored controls, an independent penetration test within the last 12 months, and security policy documents on request.
Visit the trust center (opens in a new tab)
Put your agents under privileged access control.
Book a 30-minute walkthrough with the founders.
Cookie settings
Choose which optional technologies Alter can use. Necessary technologies are always active. Read our Cookie Notice.
Necessary
Required for sign-in, security, authorization, and remembering your choices.
Always active
Analytics
Helps us understand which product and documentation features are useful.
Performance diagnostics
Uses performance tracing and privacy-masked session replay to diagnose problems.
You can change these choices at any time from Cookie settings.
来源：Hacker News · alterauth.com