YC S25 startup Alter launches authorization engine for multi-user AI agents

Agents get their own credentials

Alter, a startup from Y Combinator's Summer 2025 batch, has launched an authorization engine built for AI agents that act on behalf of multiple users. Sold as Alter Vault, the product sits on the request path between an agent and the outside APIs it calls, giving each agent a distinct identity and narrowly scoped grants instead of a shared credential.

The gap it targets

According to Alter's launch post on Hacker News, agent deployments today typically scatter API keys across .env files, config files and system prompts, with a single over-scoped production key often shared by every agent in a company. Two problems follow: any agent can do anything the key allows, and when something goes wrong — the post's example is a refund nobody can trace — there is no record of which agent acted, or on whose behalf.

The multi-user part of the launch title points at an added complication. When one agent serves many end users, a borrowed key blends the agent's own permissions with those of every person it represents, a separation that conventional secret managers and static API keys were never designed to handle.

How the engine works

The company describes a proxy-style flow: an agent identifies itself to Alter, which verifies that identity, checks scopes and rate limits, refreshes the underlying token if needed, and only then injects the real provider credential into the outgoing request as a header. The agent never handles the plaintext secret, and Alter offers proxy-only keys that cannot retrieve a credential at all. Every call produces an audit record covering the agent, the target API, the policy applied, who approved the action and the result.

Policy is default-deny, with rules that can restrict individual request parameters, and risky calls can be routed through human approval. Access can be revoked instantly for an agent, a key or a single grant, and webhook events from an identity provider cascade offboarding so a departing user's agents lose access too.

For developers, the company says a single SDK call handles storage, token refresh, policy evaluation and audit logging across 140 providers, with first-class integrations for LangChain, MCP and AWS. Part of the pitch is commercial rather than technical: policy and approval flows that a customer's security team can inspect, plus an audit trail that can be handed to a reviewer or streamed to their SIEM.

Hardening and compliance

Alter also details how the platform itself is protected. Credentials live in a dedicated secret store, encrypted at rest, with encryption keys held outside the application database; Postgres stores only metadata and references into that vault. Authorization fails closed, meaning that when a policy cannot be evaluated the request is denied, and holding a key grants nothing on its own unless an explicit record names it as a capability. Plaintext credentials are kept out of logs, and keys are isolated from one another.

On the compliance front, the company says SOC 2 certification is in progress, an independent penetration test was completed within the last twelve months, and a public trust center publishes the live state of its security controls.

Why it matters

The launch lands on a genuine and growing gap. Agent frameworks make it trivially easy to paste a powerful key into a config file, and multi-user agents multiply the blast radius because one credential can act for many people at once. The shared-key pattern fails on three fronts simultaneously: no least privilege, no attribution during incident response, and no clean way to revoke access when an agent or a user goes away.

Privileged access management is a mature discipline for human administrators. Alter's bet is that autonomous agents are simply a new category of privileged user, and that teams shipping agents against production systems — payments, source control, internal tools — will need per-agent identity, parameter-level policy and auditable approvals before a high-profile incident makes the case for them.