Identity before execution.
Each request resolves to ALLOW, DENY, or STEP_UP from the agent's registered status, Jurisdiction, Clearance, and budget policy.
AI Identity & Access Management
Zero-trust authorization for AI agents.
Give every workload an Agent Identity, owner, Clearance level, Jurisdiction scope, operating state, and request budget before it reaches the compliance pipeline.
Availability: AI-IAM is a reference implementation available within a scoped enterprise deployment. It is not the default path of the current public API. In deployments that include it, AI-IAM resolves after the independent resource-access boundary and before the Compliance Engine.
Agent registry
A durable identity for every AI workload.
Register chatbots, copilots, autonomous agents, and pipelines with the team or person accountable for each workload.
Agent Identity
Bind a stable agent_id and human-readable name to an accountable owner and agent type.
Agent states
Keep an agent active, suspend it immediately, or revoke it. Suspended and revoked agents are denied by default.
Operational record
Track creation, last-seen activity, request count, denied count, and deployment notes for each registered agent.
Five-level Clearance model
Match agent authority to data sensitivity.
An agent may handle its assigned level and every lower level. Requests above its Clearance are denied or stepped up according to its escalation policy.
Public
Public content with no internal, personal, confidential, or regulated classification.
Internal
Internal documents, employee materials, meeting notes, roadmaps, and similar business data.
Confidential
Customer, contract, financial, payroll, proprietary, and trade-secret data.
PII
Personally identifiable information supplied or detected in the request context.
Regulated
Health, credit, biometric, criminal-history, banking, and other regulated data.
Runtime scope and budgets
Constrain where and how often each agent operates.
Jurisdiction scoping
Allow all jurisdictions or enumerate the configured jurisdictions for an agent. Out-of-scope requests are denied.
Requests per minute
Set a per-agent RPM ceiling. A value of zero disables the per-minute limit.
Daily request budget
Set a daily cap for each agent. A value of zero disables the daily limit.
Authorization outcomes
One explicit effect before compliance evaluation.
Proceed
The identity is active, Jurisdiction is in scope, Clearance covers the detected data classes, and request budgets remain available.
Block and record
Unknown, suspended, or revoked identities are denied. Out-of-scope jurisdictions and non-escalatable policy failures are also blocked.
Route for review
When escalation is enabled, an insufficient Clearance or exceeded request budget can require step-up review instead of proceeding.
Separate audit boundaries
Audit authorization first. Correlate evidence on integration.
AI-IAM writes its own authorization audit. Only when AI-IAM is integrated into the Compliance Engine does the independent evidence ledger correlate that decision with request-scoped compliance evidence.
AI-IAM audit
aiiam.py records timestamp, agent_id, agent_name, effect, jurisdiction, agent_clearance, required_clearance, data_classes, violations, and latency_ms for each authorization decision.
Compliance Engine evidence integration
When integrated into the Compliance Engine, the independent evidence_chain.py associates the IAM effect with request_id, query_hash, compliance result, prev_hash, and chain_hash.
Explicit ownership boundary
aiiam.py does not generate the request hash chain. The Compliance Engine invokes evidence_chain.py to create and link request-scoped evidence records.
Enterprise customization
Fit AI-IAM to your operating model.
Map agent ownership, Clearance, Jurisdiction, escalation, RPM, daily budgets, deployment boundaries, and evidence handling to the workflows selected during discovery.
Reference implementation
Agent registry, lifecycle states, five Clearance levels, Jurisdiction scope, request budgets, explicit authorization effects, and audit records. These are available within a scoped enterprise deployment rather than as a default public API capability.
Discovery-scoped integration
Customer directory federation, SSO, and external identity-provider connections are scoped during discovery; they are not represented as generally available capabilities.
Custom deployment
Private cloud, VPC, on-premises, air-gapped, support, and integration requirements are defined around the selected production workflow.
AI-IAM enterprise
$10,000+/month custom
Start with one production agent workflow and scope its identity model, authorization policy, deployment boundary, and evidence requirements with our team. AI-IAM is provisioned as part of that scoped enterprise deployment.