Control agent access to tools, APIs, and data
See every action your agents take. Know exactly who authorized it.
Found 847 rate limit errors (last hour)
Blocked: PII requires elevated approval
datadog:logs:read
"Fetch error logs"
"When fixing bugs: allow logs:read"
task:bug-fix + logs:read
prod-db:customers:read (PII)
"Read customer PII from prod DB"
forbid when resource.tags.sensitivity == "pii"
resource:pii + trust:blocked
linear:issues:write
"Create issue in Linear"
"When fixing bugs: allow issues:write"
task:bug-fix + issues:write
github:contents:write
"Push fix to GitHub"
"When fixing bugs: allow logs:read
Anatomy of an insecure agent Anatomy of a secure agent
What's at risk? What's possible
Agents + Users 
Agent Process 
Tools + Services 
MCP Servers 
APIs 
Data Stores The path from intent to action
Keycard resolves identity, enforces policy, and issues scoped access.
The agent makes the call.
Composite identity graph
Identity resolves first. Keycard builds a composite identity from the full execution context.
Everything that follows is scoped to that resolution.
- Federated across your existing identity infra
- Identity = user + device + agent + task
- Every action maps to a human/machine identity
Enforcement at the gate
Policy evaluates at the edge, the moment an agent requests access. No credential is issued unless policy allows it.
Author rules visually, test against live traffic in observe-only mode, and roll back instantly.
- Every request evaluated. Every denial explained.
- Observe-only mode for testing against live traffic
- Instant rollback to any previous policy set
permit Application
when resource.tags.sensitivity != "pii"
unless application.tags.trust == "shared"forbid Application
when resource.tags.department == "hr"
and application.tags.trust == "shared"Task-scoped credentials
Keycard issues short-lived, least-privilege credentials bound to the task at hand. No long-lived secrets, no over-permissioned service accounts.
Every credential expires when the task completes.
- Identity-bound, resource-scoped
- Minted on demand. No long-lived tokens.
- Immediately revocable
Centralized telemetry
A real-time event stream of every agent action, tool call, and policy decision. Tamper-resistant, streaming to your SIEM.
Developer-first, compliance-ready.
- Real-time streaming to Splunk, Datadog, etc.
- Structured event stream - filter, query, alert
- Full attribution on every action
3 ways to start using Keycard
Whether you're building agents, securing the ones you already use, or adopting agentic tools across the org.
The agent you build is instantly accessible to any MCP client.
Users authenticate through the organization IdP.
The SDK handles the handshake. OAuth today, whatever comes next.
KeycardAuth({ issuer: process.env.KEYCARD_ISSUER })
Every handler receives the full picture. One import, zero config.
The agent shows intent. The user sees exactly what they're granting.
One Keycard token. Exchange it for scoped access to anything.
Token goes straight to the API. Keycard issues credentials, never proxies data.
// Agent needs Google Calendar. // Exchange the Keycard JWT for a scoped token. const sts = new STSClient(config.keycardStsIssuerUrl) const { access_token } = await sts.exchange( authInfo, "https://www.googleapis.com/calendar/v3", ["https://www.googleapis.com/auth/calendar"] ) // Use it directly. Keycard never sees the data. const resp = await fetch(calendarUrl, { headers: { Authorization: `Bearer ${access_token}` } })
Secrets injected in-memory. Never on disk. Gone when the session ends.
Agent-generated code gets scoped, short-lived credentials. Not static keys from 1Password.
import os, boto3 # Agent writes this at runtime. # .env doesn't exist on disk — # Keycard injects creds in-memory. key = os.environ["AWS_ACCESS_KEY_ID"] secret = os.environ["AWS_SECRET_KEY"] s3 = boto3.client("s3", aws_access_key_id=key, aws_secret_access_key=secret) s3.upload_file("build.zip", "deploys", "v2.3.1.zip")
AWS_SECRET_ACCESS_KEY resolved from Keycard session. Short-lived, scoped to s3:PutObject. Never written to disk. Shell, MCP, and credential events. One audit stream for everything the agent did.
Claude using Keycard to do sales?
One catalog. Department-scoped. Always current.
Every install, block, and denial. In real time.
This is what governance looks like
The system works autonomously. Escalation only when necessary.
+12ms
+15ms
+63ms
+63ms
+63ms
+63ms
+375ms
Every action enriches the model. Consent fatigue drops. Access becomes adaptive. The system gets smarter every week.
Agents act
2,847 requests today
Signals flow
Calls, denials, escalations → telemetry
Policy adapts
Context graph updates, rules redefine
Autonomy grows
Fewer prompts, broader access
