Alter gives AI agents their own keys instead of yours
Launch HN: Alter (YC S25) – Access control for multi-user agents
Alter, a YC S25 startup, launches a privileged access management layer for multi-user AI agents. Instead of agents borrowing over-scoped credentials scattered across .env files and prompts, Alter issues per-agent identities with scoped grants, default-deny policies down to the parameter, human approval for risky calls, and instant revocation. One SDK call handles storage, refresh, policy, and audit across 140 integrations, with LangChain, MCP, and AWS support, plus an audit trail streamable to a customer's SIEM.
Give agents their own keys, not yours.
- 911viper
Following the same thread as souvik1997 here: the leak problem gets worse in shared rooms than in shared sessions. When several principals (humans plus their own agents) sit in one channel, the transcript becomes the privilege boundary. Whatever an agent read in a higher-privileged turn is sitting in the context of every later turn in that room.
What we hit building exactly that, rooms where humans and bots are peers: you can't scope a token to an agent, you have to scope it to an (agent, room) pair, and then decide what happens to the derived artifacts. Tool output, file handles, and the memory blob the agent writes back all outlive the session and get replayed into the next one.
So how are you handling derived state? Is agent memory a new principal holding the intersection of the rights of the sessions that fed it, or does it just inherit and you rely on the model not to act on stale context?
- mauvehed
That website is literally a vibe-coded template.. How can we put any trust into the app itself?
- souvik1997
Looks cool!
One aspect of multi-user agent security, which I think is underexplored, is how context from a higher-privileged session might "leak" into a lower privileged session. Suppose the CEO of a company uses your shared openclaw agent and the agent writes sensitive data (investor emails, for example) to its memory. My understanding is this is not protected by Alter. Then a contractor uses the same agent and can read that same memory. It seems to me that a better agent harness for this kind of multi-user use case is needed; the standard ones like openclaw and claude code simply are not designed for it. Would love your thoughts!