Alter (YC S25) 推出面向多用户 AI 智能体的访问控制平台
Launch HN: Alter (YC S25) – Access control for multi-user agents
Alter (YC S25) 推出面向多用户 AI 智能体的访问控制平台 Alter Vault，主张为每个智能体分配独立密钥和细粒度授权策略，并对每一次调用进行身份核验、范围检查与审计记录。产品覆盖 140 家第三方服务，提供 LangChain、MCP 与 AWS 集成，原始凭证仅存于独立 Vault 并默认 fail-closed 拒绝，SOC 2 合规正在进行中。
Alter 为多用户 AI 智能体引入独立密钥与逐次授权审计，给正在搭建多智能体系统的团队提供了可直接借鉴的访问控制与合规审计模式。
Alter Vault | Authorization Enginegnt_7x92k
Incoming Request
A
sales-agent
agent: ai_agent
GET api.github.com/user/repos
Policy Evaluation
✓Identity verified
✓Scope check: repo:read
✓Rate limit: 847 / 1,000
✓Token refreshed (3m ago)
Authorization Result
APPROVED
Injected Headers
Authorization: Bearer ghp_••••••••k4m2
X-Alter-Grant: gnt_7x92k
Audit Log
action: token.proxy
agent: sales-agent
target: github.com
status: 200 OK
latency: 142ms
140 integrations
In-path enforcement
SOC 2 in progress
Give agents their own keys, not yours.
Without Alter
.envOPENAI_API_KEYsystem-prompt.mdSLACK_BOT_TOKENci-config.yamlSTRIPE_SECRET_KEY
Keys scattered everywhere
Pasted into prompts, configs, and .env files across every repo.
admin-key-prodused by: all 14 agents
One key does everything
Every agent borrows the same over-scoped credential.
Who refunded that charge?No results found.
No answers afterward
Nobody can say which agent did what, or on whose behalf.
Building agents
Pass your customers' security review
- Per-agent identity and scoped grants instead of one shared key
- Policy and human approval a customer's security team can inspect
- An audit trail you can hand to a reviewer, streamed to their SIEM
Securing agents
PAM controls for a new kind of privileged user
- See every call an agent makes through Alter: which agent, whose access, which policy, who approved
- Default-deny policy down to the parameter, and approval for risky calls
- Revoke an agent, key or grant instantly; IdP webhooks cascade offboarding
How it works
Alter authenticates, authorizes, and logs every request
One SDK call handles storage, refresh, policy, and audit for 140 providers. First-class LangChain, MCP, and AWS integrations.
Platform
One platform between your agents and every API
Four features on a single request path.
Use cases
What teams build on Alter
Every card is a working guide with code.
How the platform itself is secured
- Credentials live in a dedicated secret store, encrypted at rest, with keys managed outside the application database
- Fail-closed authorization: if a policy cannot be evaluated, the request is denied
- Zero-trust ownership: a key confers no capability without an explicit record naming it
- Postgres holds metadata and vault references; provider tokens and credentials live only in the vault
- Per-key isolation, plaintext credentials never in logs, and proxy-only keys that cannot retrieve a credential at all
Controls monitored continuously
SOC 2 in progress
Our trust center publishes the live state of our security program: monitored controls, an independent penetration test within the last 12 months, and security policy documents on request.
Visit the trust center (opens in a new tab)
Put your agents under privileged access control.
Book a 30-minute walkthrough with the founders.
Cookie settings
Choose which optional technologies Alter can use. Necessary technologies are always active. Read our Cookie Notice.
Necessary
Required for sign-in, security, authorization, and remembering your choices.
Always active
Analytics
Helps us understand which product and documentation features are useful.
Performance diagnostics
Uses performance tracing and privacy-masked session replay to diagnose problems.
You can change these choices at any time from Cookie settings.
来源：Hacker News · alterauth.com