An AI agent that can read a calendar may also be able to change it. An API key that makes a useful prototype work may give the same process access to more data and actions than the task requires. As agents start doing work across business systems, the question becomes who authorized each action and how that authority can be limited or removed.
Alter provides an access layer for those calls. Its current product brings together a credential vault, policy enforcement, agent identities and an audit trail. The aim is to let developers connect agents to external services while giving operators a place to control the access being used. [1]
A team working on the authorization boundary
Alter joined YC’s Summer 2025 batch and was founded by Srikar Dandamuraju and Kevan Dodhia. Dandamuraju previously worked on platform engineering at Goldman Sachs; Dodhia previously founded Compute.ai. Their public YC description focuses on identity and access controls for agents. [2]
This is a separate responsibility from deciding whether a model understands a task. A model may propose a plausible action that exceeds the user’s authority. Access controls need to apply at the point where the proposed action reaches a service, including when a prompt or application makes a mistake.
Connect a service without building the whole token lifecycle
Alter’s documentation describes a shared request path for OAuth connections and managed secrets such as API keys. A user can authorize a connection, or an operator can provision a secret. Application calls then pass through authorization and policy checks, credential handling and audit recording. OAuth refresh is handled as part of that path. [3]
There are two runtime modes. In retrieve mode, the SDK briefly handles the credential inside the application process. In proxy mode, credential injection and the provider call remain on Alter’s backend. Alter’s security reference explicitly notes that a compromised application process can inspect a credential held in retrieve mode. Buyers should choose the mode that fits their trust boundary rather than assume every integration keeps secrets outside the process. [6]
Give each agent its own access
The scoped-access guide gives an agent its own identity and API key, then binds only the credentials it needs. A user can delegate an OAuth connection, while an operator can attach a managed-secret grant. The guide also describes narrowing scope along a delegation chain and attributing actions to the agent performing them. [4]
Consider a scheduling assistant used by several employees. Each employee’s connection needs to stay distinct, and the assistant should receive only the access needed for that person’s task. An independently revocable agent identity gives the operator a way to stop that workload without treating every application using the same external service as one actor. This is an illustrative application of the documented access model.
Alter’s platform page adds policies based on endpoints, HTTP methods and request parameters, alongside controls such as limits and time windows. Those controls let a team express a narrower permission than possession of a broad provider token alone would imply. [1]
Pause a sensitive action for a person
The human-approval guide describes a call that returns a pending approval instead of immediately executing against the provider. The application presents a review link to the designated person, who approves or denies the request. The application then receives the eventual outcome. These approval rules use the proxy request path. [5]
A support agent preparing a refund is a concrete example in the documentation. It can assemble the proposed request while an approval policy determines whether a person must authorize execution. This allows a team to distinguish information gathering from a consequential change, while keeping the decision connected to the request that will actually be sent. [5]
For an operator, the important consequence is a visible handoff. A pending request must reach a responsible person and its outcome must return to the workflow. Simply adding an approval screen does not ensure that the right person saw the right action at the right time.
Keep the control useful after rollout
Alter’s security reference describes revoking a user’s delegation separately from disconnecting the underlying service connection. It also documents denial when authorization or policy checks cannot be completed. The audit trail records credential and provider activity, giving teams a way to investigate calls after the fact. These are documented product behaviors, rather than a claim that the surrounding agent application is automatically secure. [6]
That lifecycle is particularly relevant when a pilot becomes several agents with different owners. Access that was reasonable for an initial workflow can become too broad as tasks change. A separate record of identities, grants and calls makes it easier to review those changes deliberately.
Where Alter fits on SOTA2
| Product & task | Position | Comparison scope |
|---|---|---|
| Alter VaultManage Access PermissionsCross-industry | #1 | 10 companies · 10 candidates 9 ranked products |
| Alter VaultAuthenticate to ServicesAgent | #2 | 9 companies · 9 candidates 9 ranked products |
What we would look for in a pilot
We would test one read action, one permitted write and one action that should be refused. Add an approval gate, revoke the delegated access and repeat the call. Check what the user, operator and audit record each show, including when a provider fails or a request remains pending.
The architecture review should establish where credential material exists in the selected mode and how application identity maps to the user’s connection. Measure the additional latency and the effort required to maintain policies as the workflow changes.
The SOTA2 view
Alter is relevant to teams moving agents beyond read-only demonstrations into connected business work. Its useful role is to make access a managed part of that work: specific identities, bounded permissions, reviewable actions and revocation. The quality of the deployment still depends on how the application uses those controls.