With an end date and a sponsor
- Email invitation with passkey
- Organisations and domains
- Scope by apps, groups and PAM
- SCIM with userType
AI agents & external access · identities with an end date and a sponsor
Outsiders will get in too. With an end date, and someone answerable.
Contractors, auditors, partners and your own AI agents need access. AuthGuard is being designed to give them only what the engagement allows, only until it ends, and to put a person in front of every critical action an agent takes.
In development This capability is being built. Talk to us to join the pilot programme.
- Mandatory sponsor
- Automatic end date
- Approved on the phone
- Instant stop
Phone approval · conceptillustrative example
AgentRequested by agent “Billing Assistant” on behalf of Ana Ribeiro
- Operation
- Transfer
- Amount
- EUR 1,250.00
- IBAN
- PT50 •••• •••• 1234 new payee
- Reference
- INV-2026-0042
Why we ask for your attention
- A new payee for this agentagent
- An amount above this agent’s usualamount
- Allow
- Passkey
- Phone
- Second approver
- Deny
DeclineStop this agent
- Agent proposes
- Person approves
- Receipt
- Execution
How it will work
Sponsor, scope, approval, stop.
External people and AI agents will follow the same rules: someone answers for them, the scope is closed and every critical action an agent takes goes through a person.
-
01 · Sponsor
Someone will answer for every access.
Every external person and agent will have an employee sponsor and an end date. At the end, access stops by itself: sessions, groups, privileged access and pending requests.
-
02 · Scope
Only what the engagement allows.
Applications, groups and privileged access profiles will be chosen at invitation, and a badly written policy rule will not be able to widen them. Today, see identity management.
-
03 · Approval
The agent proposes, a person approves.
The agent will act for whoever delegated to it, with narrowed permissions. Every critical action will reach a phone with the exact operation and end in a signed receipt naming the agent, the delegator and the approver. How phone approval works today.
-
04 · Stop
Stop in one tap.
One agent, all of a vendor’s agents, or all of them: the design has tokens stop working immediately and privileged sessions close within a minute.
Illustrative example · how it will work
The audit ends on 31 March. So does the access.
Marta, an auditor at Silva & Associados, will get an email invitation, create a passkey, and her sponsor confirms it on the phone. She will see the ERP and the archive, nothing else.
Each month her sponsor re-confirms with one tap that the access is still needed. At midnight on 31 March, access ends and the seat is freed.
Illustrative example · how it will work
The agent prepares. Ana decides.
Imagine the company’s billing agent holds a delegation from Ana: propose supplier payments of up to €5,000 a day, until the end of the quarter.
When an invoice arrives with an unfamiliar IBAN, the agent proposes the transfer. Ana’s phone will show the agent’s request on her behalf, the amount, the IBAN and the risk engine’s warning: “A new payee for this agent”.
If Ana chooses “This isn’t what I asked for”, the request is declined and, after the third decline in a row, the agent will be suspended automatically. The agent is designed never to see the bank password: it can only propose.
Comparison
The usual way, and what will change.
| The usual way | How AuthGuard is being designed |
|---|---|
| Guest accounts nobody disables | Mandatory end date; access stops by itself |
| “Who asked for this access?” | Mandatory sponsor and periodic reviews |
| Agents with a permanent API key and admin rights | Own identity, 5-minute tokens, only what was delegated |
| “The agent did it on its own” | Every critical action approved by a person, with a signed receipt |
| Passwords pasted into the agent’s prompt | Sessions through the gateway; the agent never sees the credential |
| Stopping an agent means visiting several systems | One button: agent, vendor or all |
- The usual way: Guest accounts nobody disables
- How AuthGuard is being designed: Mandatory end date; access stops by itself
- The usual way: “Who asked for this access?”
- How AuthGuard is being designed: Mandatory sponsor and periodic reviews
- The usual way: Agents with a permanent API key and admin rights
- How AuthGuard is being designed: Own identity, 5-minute tokens, only what was delegated
- The usual way: “The agent did it on its own”
- How AuthGuard is being designed: Every critical action approved by a person, with a signed receipt
- The usual way: Passwords pasted into the agent’s prompt
- How AuthGuard is being designed: Sessions through the gateway; the agent never sees the credential
- The usual way: Stopping an agent means visiting several systems
- How AuthGuard is being designed: One button: agent, vendor or all
What is being built
Govern, delegate, prove.
Delegation, not master keys
- Narrowed delegation (RFC 8693)
- Every critical action approved on the phone
- Limits per minute, day and amount
- Per-agent risk baseline
- MCP server
Who asked, who approved
- Signed receipts naming agent, delegator and approver
- Full lineage in the audit log
- Single-use approval token for your system
- Offline verification
Worth knowing
- This capability is in development: nothing on this page is available today, and no date has been announced.
- Agents will never be administrators and will never approve requests, their own or anyone else’s.
- Every critical action by an agent will need a person; there will be no auto-approval.
- By default agents will receive no secrets: they will use privileged sessions through the PAM gateway, which are recorded.
- Licensing for external people and agents is still being defined.
- Agents will be available on the Standard profile, and approving agent requests will need an up-to-date phone app.
In the help centre
Articles on external people, agents, the emergency stop, approving agent requests, the MCP server and token exchange will be published in the help centre when the capability is available.
Pilot programme
Start with one engagement and one agent.
Join the pilot programme: pick one external contractor and one agent with a single operation, and we test reviews, receipts and the stop button with your team as they become ready.
Join the pilot