A governed agentic workforce.
AI agents onboarded as first-class organizational principals, governed exactly like employees. Every action they take is authorized deterministically. Models advise; only policy authorizes.
The discipline, rebuilt for the AI era.
Identity and Access Management has stood on four pillars for decades: Authentication, Authorization, Administration (identity lifecycle management), and Auditing (accounting). The AI era breaks the assumption under each, because principals now act autonomously, continuously, and at machine speed. OGIAM IAM rebuilds all four for agents, so AI can be governed with the same rigor as people, and more.
Authentication
Who or what a principal is, and whether it can prove it.
People and service accounts sign in with passwords, MFA, and SSO.
Every agent is a first-class principal with a verifiable, standards-based identity (OIDC, issuable through Entra), authenticating with short-lived credentials, never a shared key. It proves who it is before it acts.
Authorization
What a principal is permitted to do.
A role or policy grants access, usually once per session or scope.
Every individual action is authorized deterministically: allow, deny, transform, or escalate. Models advise; only policy authorizes. Autonomous agents act continuously, so the decision moves to each action.
Administration
Identity lifecycle: provisioning, change, and deprovisioning over time.
Human accounts are onboarded, re-roled, and offboarded.
Agents are onboarded like employees (invited, role-scoped, human-owned), auto-paused when behavior drifts, and retired. What one agent learns passes to the next as deterministic code, so the workforce scales without re-teaching.
Auditing
Accounting: a trustworthy record of what actually happened.
Access logs are retained for compliance.
Every decision is written to a hash-chained ledger, reproducible and explainable, attributed to the agent acting for its owner. Accounting extends to cost, not just access.
This is what OGIAM IAM is: the four pillars of identity, reimagined for a workforce that is part human and part agent. Identity an agent can prove, authorization decided on every action, a lifecycle that watches behavior, and an audit trail that makes autonomous action accountable. It is the future of IAM for the AI era.
Every agent is an identity, not a script.
Each agent carries a role, an owner, and a lifecycle, the same way a person does. The identity is standards-based (OIDC, issuable through Entra), so OGIAM acts as a portable policy enforcement point. The gate travels into an existing client system that lives outside our platform.
What the agent is allowed to be, scoped to a function.
A named human accountable for the agent and its escalations.
Provisioned, active, paused, and retired like any principal.
An agent learns its own ceiling.
On arrival an agent authenticates, scans the platform, and discovers the tools available to it and the capability ceiling it must operate within. Nothing is assumed; the agent learns what it can do before it does anything.
It does the whole job, not one trick.
Once an agent has scanned a system, it can carry out the normal work a person would do there, end to end, not a single canned action. It breaks a request into steps, runs them in order, and feeds each result into the next. When a step needs something the system does not hold, it can reach outside (a web lookup, for example) and bring the answer back. Every step still passes through the gate.
The agent works on behalf of its human owner, using that person’s identity, never a shared master key.
Its reach is capped by the owner’s own access. It can never do something the owner could not do.
The authority it borrows is short-lived and tied to the task at hand, then it is gone.
The model proposes; a deterministic policy gate decides, executes, and records every action. The same path runs for every request; a multi-step job just loops the middle steps, with the gate deciding each one.
One agent. Your whole connected stack.
An agent does not live in a single app. Connect your tools once and it works across all of them, drawing on the full range of your data to act and to surface insight. Salesforce and your CRM, Microsoft 365, your repositories: the agent reaches each through a real, standards-based connection. Every action, in every system, still passes through the same gate, governed and recorded.
Mail, calendar, tasks, files, and Teams.
Read and write records over a real OAuth connection.
HubSpot and others through the same connector framework.
GitHub pull requests and project signals.
Connect any REST or OAuth vendor; the agent inherits it.
Connected through OAuth and a vendor preset. New surfaces are added the same way, so the reach grows without changing how anything is governed.
“Find the accounts that went overdue in Salesforce, cross-reference when we last emailed them in Outlook, and draft a follow-up for each.”
One sentence, three systems, one governed run. Because the agent can see across the tools it is connected to, it turns the range of your data into insight and action, and every step is still authorized and recorded the same way.
A decision on every action.
For each action OGIAM decides allow, deny, transform, or escalate. The decision is deterministic and explainable; every outcome names the rule that fired. Models can propose, but they never authorize.
- AllowAuthorized in-role work runs as the agent would expect, inside its capability ceiling.
- EscalateHigh-risk actions (money movement, outbound send, deletion, privilege change) escalate to the human owner before anything happens.
- TransformAn action is reshaped to stay within policy rather than rejected outright, when policy allows a safer form.
- DenyOut-of-role requests and access to secrets are refused. The decision names the rule that fired.
Authorized in-role work runs. High-risk actions, such as money movement, outbound send, deletion, or a privilege change, escalate to the human owner. Requests for secrets are denied.
Because the gate is deterministic, the same request yields the same decision, and the rule behind that decision can always be read back.
Every agent operates inside an enforced capability ceiling and cannot exceed it. The ceiling is decided by policy, not by a model’s discretion, so the limits hold even when the underlying model changes.
Every decision and action is recorded in an append-only, tamper-evident ledger, so there is a verifiable record of what was decided, why, and what happened. The trail is continuously verified, and genuine tampering is flagged for a human to review.
An agent acts inside an explicit authority boundary it cannot exceed. High-risk actions are held for human approval and secrets are refused outright, all decided deterministically rather than left to a model’s judgment.
Every change arrives as a reviewable artifact.
When an agent proposes a change, it comes back as a review-gated pull request your team approves, never an unreviewed write. Your engineers stay in the loop on anything that alters a system, with a clear artifact to read, question, and sign off on first.
Test a policy against real traffic, then enforce it.
The gate starts by recording what an agent would do. Turning recording into blocking is a decision you make deliberately, per capability, on your own schedule. Dry-run a candidate policy against your real decision history, see exactly what it would have stopped, then graduate each capability from monitor to enforce with no code deploy. Every posture change lands in the hash-chained audit trail.
Dry-run any candidate enforce-set against your real decision history before you turn it on. It replays the policy over the recorded, tamper-evident ledger and shows exactly what it would have blocked, by capability and by agent, the way you would test a firewall rule before enforcing it.
Graduate any capability from monitor to enforce, per workspace, with no code deploy. Every posture change is written to the hash-chained audit trail, so the move from observed to blocked is itself on the record.
Discover every place AI touches your systems: every model SDK call, provider endpoint, and AI key in your code. The ungoverned ones are surfaced for you, because you cannot govern what you cannot see.
- delete_recordsAgent3×12Would block
- export_contactsAgent2×4Would block
- send_bulk_emailAgent1×7Would escalate
- read_tasksAll agents×318Would allow
Replayed against real history. Nothing was blocked yet; this is what the candidate policy would have done.
Each capability sits at monitor or enforce, per workspace. Graduate one without touching code. The change is written to the hash-chained audit trail the moment it happens.
- read_calendarMonitor
- create_taskMonitor
- export_contactsEnforce
- delete_recordsEnforce
Monitor records what the AI would do. Enforce blocks it. You move the line per capability, on your schedule.
You cannot govern what you cannot see.
Before you can put AI behind the gate, you have to find it. The AI Surface Inventory discovers every place AI touches your systems: every model SDK call, every provider endpoint, and every AI key in your code. The ungoverned ones are surfaced for you, so the shadow AI a team stood up on its own does not stay invisible.
Governs any AI. Any model, any framework.
The checkpoint does not care which AI you use. Any model, any agent framework, today’s or next year’s, runs behind the same deterministic gate. The AI brings the intelligence; the gate decides what is allowed, executes it deterministically, and records it. Adopt the most capable AI without inheriting its risk.
Swap in the most capable model the day it ships. The governance layer never changes.
However an agent is built, every action it takes still passes through the same gate.
The intelligence improves; the limits hold. Your security posture does not move with the model.
An AI assistant tries to delete a customer record. The gate checks your policy, blocks it, and logs exactly what happened and why.
Whatever AI a team brings, every action it wants to take is checked against your rules first, then allowed, blocked, or sent to a person for approval, with a tamper-evident record either way. You adopt AI without losing control or the ability to answer for what it did.
Even when agents act, they stay on the leash.
When an agent operates a browser or an app, every action passes through the gate first: read-only by default, changes only with explicit, scoped authorization, and a tamper-evident record of every step. An agent observes freely and can never quietly act beyond what you authorized.
An agent can look at anything in front of it without changing a single thing.
Any action that alters something requires explicit, scoped authorization first.
A tamper-evident record captures every move, so nothing happens off the books.
Direct it the way you would a person.
Say what you want in a sentence. One agent will carry out a whole sequence of different actions to deliver it, and you can put several agents to work at once, each on its own job. Every step, for every agent, still passes through the gate.
“Agent1, scan my calendar for next week, draft a prep task for every external meeting, pull recent news on each company, and make a tracked link for the deck.”
- 01read_calendarFinds three external meetings next week.Allow
- 02create_taskDrafts one prep task per meeting.Allow
- 03web_searchPulls recent news on each company and attaches it.Allow
- 04create_tracked_linkGenerates a tracked link for the deck.Allow
- 05send_emailOffers to email each organizer a heads-up.Escalate
One sentence, five different actions, chained end to end. The in-role steps just run; the outbound step is held for the owner’s approval. Nothing skips the gate.
Scan next week and create a prep task for every external meeting.
Pull this month’s news on our top three accounts and save a brief.
Generate a tracked link for each landing page and list them.
Each agent is its own principal, with its own owner and its own ceiling. They work in parallel, and the ledger attributes every action to the agent and the person it acted for.
What one agent learns, the next inherits.
A verified procedure can carry forward. A second agent inherits the first agent’s procedures, but only after an adversarial re-check before any procedure is promoted. The re-check is the anti-poisoning step: a procedure has to survive scrutiny before it becomes shared knowledge.
A procedure is proven by the agent that first ran it.
An adversarial pass tests the procedure before it is trusted.
Only procedures that survive the re-check are inherited.
The first agent does the learning by exploration. Its learning is captured and handed forward as deterministic code, not as skills or instructions, which is why each added agent is productive immediately and behavior stays governed.
The first agent’s learning is captured and handed forward as deterministic code, not as skills or instructions, which is why each added agent is productive immediately and behavior stays governed.
What is inherited
A verified, replayable sequence. Identical every run, governed step by step by the gate, proven once and then reused.
What is not inherited
Natural-language guidance re-interpreted on every run. Non-deterministic, and its behavior can quietly drift.
Agents stay in check across model changes.
A behavioral baseline is built from the decision ledger. When an agent diverges past a threshold, OGIAM auto-pauses it and notifies its owner. As underlying models change, the baseline keeps behavior accountable.
- read_tasksAllow
- create_taskAllow
- read_calendarAllow
- update_taskAllow
- export_contactsEscalate
- send_bulk_emailEscalate
- delete_recordsDeny
Mostly in-role reads and writes; near-zero block rate.
Unfamiliar tools; rising escalate and deny rate.
The decision stream is the signal. The gate authorizes every action and, from that same ledger, computes divergence from the agent’s established decision pattern. Past the threshold it auto-pauses the agent and notifies the owner.
One checkpoint, between your people and your systems.
The whole design is simple to picture. Your workforce, people and agents alike, sits on top. Your existing systems sit at the bottom. Nothing reaches a system without passing through one checkpoint in the middle, and everything that passes is written down.
Both carry a real identity and a named owner.
Every single action stops here first. OGIAM decides, the same way every time, and names the rule behind the decision.
Connected once over OAuth, governed identically. The checkpoint travels to each system; your data stays where it already lives.
Every decision and every step, from the first words you typed to the final result, is written to a tamper-evident ledger you can read back in full.
Proven procedures are captured and handed to the next agent as code, so the workforce improves without anyone re-teaching it.
Bring your own agent.
You do not have to replace the AI you already use. Plug your existing agent in behind the gate with a key, and it keeps doing its job exactly as before. The difference is that from then on, every action it takes is governed and recorded. You keep your AI, and you gain the controls and the audit trail. No rip-and-replace.
Plug your existing AI in behind the gate with a key. It keeps doing what it already does.
From that moment, every action it wants to take is checked against your rules first.
Allowed, blocked, or held for approval, every step lands in the tamper-evident log.
We prove the gate works, on demand.
Trust should be something you can check, not something you have to assume. On demand, the system runs a live self-check that shows every decision was correct, fast, and fully recorded. It is like a vault you can ask to demonstrate its lock in front of you. For a security or compliance team, that turns a promise into something they can watch happen.
It replays a run of allowed, blocked, and held-for-approval actions and shows each one landed the way your policy says it should.
It shows the checks happen in the moment, so governance does not slow the work to a crawl.
It shows every action left a record in the tamper-evident log, with nothing missing and nothing quietly changed.