Akeyless ships Runtime Authority, authorising AI agents per action instead of per session

Akeyless has launched Runtime Authority for AI agents, an intent-aware authorisation layer that decides at the moment of action rather than at the start of a session. Access adapts per request, policy is evaluated in real time, and unsafe actions are blocked as they are attempted. The design is secretless: agents never hold API keys, passwords, or tokens, and have no direct connectivity to target systems, with zero standing privileges and just-in-time grants across cloud services and on-premises applications, databases, and infrastructure. Sessions are continuously monitored and revocable, and every action ties back to the prompt that triggered it. Chief executive Oded Hareven framed it as control rather than visibility.

Why it matters

The identity industry spent 2026 agreeing that agents need identities. The harder question is granularity. Authenticating an agent once and handing it a session is the OAuth model, and it fails badly here because a compromised or confused agent does thousands of things per session that no human would.

Per-action authorisation is the right unit, and Akeyless is not alone in that view: P0 Security, C1, and Saviynt's Zuma make versions of the same argument. The differentiator worth testing is the prompt-to-action audit chain, because in an incident the question auditors ask is which instruction caused which command, and almost nothing answers it today.

Cost is latency on every call and a new hard dependency in the execution path. Model that before rollout. See secrets management and securing AI agent identities.

Source: Akeyless