ContactBook a demo

Agent Authorization

Govern every agent.Entitle its tools.Decide before it acts.

Trustivan governs AI agents on the graph that already governs your machine identities: an owner and a declared autonomy for each agent identity, tool entitlements an operator grants, and a runtime gate — thirteen deny-by-default rules an agent runtime calls before it acts. No connector discovers an agent, and no screen registers one.

AvailableAgent Authorization · Secure Every ActionThe runtime gate decides over tool entitlements an operator declared

Book a demoExplore AI Agent Security

Available: agent identity, ownership, autonomy, MCP tools, tool entitlements, runtime ALLOW · CHALLENGE · DENY · Not built: agent discovery, agent lineage

The problem

An agent is not just another service account.

It inherits credentials, assembles its behaviour at runtime from untrusted text, calls tools and delegates to other agents — at machine speed.

Code path
Service accountFixed, reviewed and deployed
AI agentAssembled at runtime from instructions, tools and whatever lands in its context
Inputs
Service accountStructured parameters from a known caller
AI agentUntrusted text: documents, web pages, tool outputs, messages from other agents
Authority
Service accountOne role for one purpose
AI agentInherited credentials across many systems; every tool and MCP server adds reach
Delegation
Service accountRare and explicit
AI agentRoutine: agents call agents, tools call tools, and accountability thins with each hop
Change
Service accountChanges through a deploy
AI agentChanges with a prompt edit, a model update or a newly discovered tool
Governing question
Service accountIs this account still needed?
AI agentShould this agent perform this action on this resource, right now, with this authority?

Reach

One agent. Ten systems. Every credential it inherited.

Agent authority is the sum of the credentials, grants and tool bindings behind it — which is why agent security starts with identity, not prompts.

How it works

Inventory. Identify. Own. Govern the tools.

Built so an agent finding knows its owner, its credentials, its tools and its entitlements — and honest about what no connector can find.

M6–M7 · Available
Inventory

Govern the agents you have, and see what no connector finds

Agents show up as OAuth apps, service principals, MCP configurations, CI jobs and personal coding assistants. No connector discovers an agent, and no screen registers one — so Trustivan discovers the MCP servers and tools they call, and an agent identity with authority but no owner or profile becomes a finding.

  • Agent inventory: agent identities with their owner, autonomy and entitled tools; on a real deployment it starts empty and says so.
  • Unowned is a finding: an agent identity with no accountable owner, or no profile, is raised as a finding, not a curiosity.
  • Agent-created identities: not linked back to an agent — lineage between agents is not built, by design.
Explore agent inventory
Identify

Give every agent an identity, an owner and a declared autonomy

An agent you can govern has a name, an accountable owner, a declared autonomy and runtime credentials a person mints. Trustivan keeps that record so agent authority can be reviewed the way any other identity is — from evidence, not from the agent's description of itself.

  • Runtime credentials it holds, one to ninety days, shown once, stored as a digest and revocable.
  • Autonomy declared: an undeclared autonomy is a finding, and the gate challenges a mutating action it cannot place.
  • Delegation between agents: not recorded — no agent-to-agent edge exists, by design.
Explore agent identity

research-agent

AI agent identity · owner: ML platform · autonomy: supervised

Agent identityOwner assigned1 tool effect unstated

Credentials it holds

  • Agent runtime credentialexpires in 30 days · minted by a person · revocable
  • AWS role, through its identityresearch-read · read on 2 accounts

Tools & MCP servers

  • web.search
  • repo.read
  • warehouse.query
  • warehouse.export
  • drive.read
  • mcp://finance-toolsunverified

Entitlements

  • 5tools entitled
  • 2mutating
  • 1effect unstated

From the tools an operator entitled and the effect each declares, not from the agent's description of itself.

Declared profile

Owner
ML platform (team)
Framework
agent framework (as recorded)
Autonomy
supervised · declared by an operator
Delegates to
not recorded — no agent-to-agent edge exists
An agent with an owner, a declared autonomy and entitled tools can be governed. One without a profile is a finding.Illustrative · synthetic demo agent
Govern tools

Govern tools, MCP servers and entitlements

Every tool is a capability and every MCP server is a supplier of capabilities. Trustivan discovers the tools an MCP server lists, records the effect its publisher declares or an operator sets, and lets an operator entitle each tool to an agent — so an agent's authority comes from its entitlements, not its prompt.

  • Tool entitlements per agent, declared by an operator, with each tool’s effect as the publisher or an operator stated it.
  • MCP discovery: servers and the tools they list, without calling a tool or reading its resources.
  • Unclassified means challenged: a tool whose effect nobody has stated is challenged by the gate.
Explore agent tools

Capabilities

Agent security, delivered as focused capabilities

Six capabilities, reading from and writing to the same graph as your non-human identities — each described for what it is.

Agent Inventory

Govern agent identities, their profiles and autonomy. No connector discovers an agent, and no screen registers one

Agent Identity

Give each agent identity an accountable owner, a declared autonomy and runtime credentials a person mints

Agent Tools

See the tools an MCP server lists, the effect each declares and the entitlements an operator granted

MCP Security

Discover MCP servers and their tools without calling one, and challenge any tool whose effect nobody has stated

Agent Permissions

Resolve an agent identity’s reach on the identity graph and the tool entitlements behind it

Agent Provenance

Not built, by design: no agent-to-agent edge exists, and the lineage finding reports that it cannot tell

Runtime

The model can request an action. The authorization system decides.

An LLM is never the security boundary. Trustivan evaluates each agent action a runtime sends it outside the model, from evidence an injected instruction cannot reach.

M8 · Available
Secure Every Action

Authorize every high-impact action outside the modelAvailable

The runtime gate is built: an agent runtime presents its credential, and thirteen deny-by-default rules read the tool an operator entitled to the agent, the effect of the call, the resource's impact, the declared autonomy and the grants standing behind it — ALLOW, CHALLENGE or DENY, strictest wins, recorded with the rules that fired. It decides what a runtime asks it; resistance to prompt injection comes from where the decision is made, not from the prompt.

Should this agent be allowed to perform this action against this resource, right now, with this authority?

Explore Secure Every Action
Runtime

What the gate does not yet do

Tool entitlement, runtime identity, the verdicts and their immutable decision records are implemented on the same graph, so each decision can be explained and audited, and a repeated requestId is answered with the recorded decision. Three things named alongside them are not, and are labelled here so nobody plans against them.

  • Credential brokering: issuing scoped, short-lived access at the moment of an approved action — a future capability. Today a person mints a runtime credential through the API, bounded to at most ninety days and revocable.
  • Agent-to-agent trust: not built, by design. No agent-to-agent edge exists, so nothing evaluates a chain.
  • Parking a session: holding a session or a capability until a human has reviewed it — a future capability. The gate decides one action at a time; a quarantined identity is denied every action.
Explore agent runtime security

Threat vocabulary

Name the failure modes. Then notice where they end.

Eight agent threats security teams are asked about most — every one of them terminating in an action that should, or should not, be authorized.

  • Prompt injection

    Instructions smuggled into the model’s input that redirect what the agent does next

  • Indirect prompt injection

    The same attack arriving through a document, web page, email or tool output the agent reads

  • Tool poisoning

    A tool or MCP server whose description or output steers the agent into misusing its authority

  • Confused deputy

    An agent with legitimate authority tricked into acting for a caller who has none

  • Delegation abuse

    A chain of agents in which authority grows, or accountability disappears, with each hop

  • Excessive autonomy

    High-impact actions taken without approval, purpose or evidence because nothing required them

  • Agent impersonation

    An identity that claims to be a known agent to inherit its credentials and permissions

  • Goal hijacking

    The agent’s objective replaced mid-task, so ordinary tools are used toward the wrong end

Every one of these ends the same way: an identity attempts an action on a resource. Defences inside the model raise the cost of an attack; they do not create a boundary. The model can request an action. The authorization system decides.

Cross-pillar

Agent authority is machine authority

The identities an agent acts as and the credentials it inherits are governed by the other two pillars — on the same graph, with the same evidence.

Explore the platform
Govern

Identity Governance

Discover, classify and own non-human identities — service accounts, roles, workloads, bots, apps and automation.

Discovery & Inventory

Discover IAM roles and machine users, GitHub Apps and bots, Kubernetes service accounts and Vault AppRoles across your connected estate

Ownership & Lifecycle

Attach every identity to an accountable owner and a lifecycle state — and flag the orphans that nobody claims

Explore govern
Secure

Credential Security

Map credentials to the identities that use them, the services they unlock and the blast radius they carry.

Credential Mapping

Link access keys and other credential metadata to their identities, owners and the resources they can reach

Exposure & Rotation

Flag exposed, long-lived, shared and expiring credentials and overdue rotation, with evidence and a remediation a second person approves

Explore secure

See your agents, their tools and their authority.

A demo covers agent identities, MCP tools, tool entitlements and runtime ALLOW, CHALLENGE and DENY decisions on the synthetic demo estate.

Book a demoExplore agent use cases

Resources

Why the model is never the boundary

Research and guides on agent authorization, prompt injection and the relationship model that governs every identity.

Browse all resources
BlogJul 28, 2026·7 min read

Shadow AI is an identity problem

Blocking AI tools does not stop shadow AI. Agents show up in the identity layer as new principals, OAuth grants and tool bindings — which is exactly where you can govern them.

Read more
Product updateSep 12, 2026·5 min read

Classification, ownership and lifecycle, as built

How Trustivan types each identity, records who owns it and on whose word, and tracks where it is in its life — with evidence behind every value and unknown shown as unknown.

Read more

Decide what an agent may do before it acts.

See how TRUSTIVAN connects identity, credential, access, agent and action context into one control plane.

Book a demo