The security review, answered

Credentials

Where are third-party credentials stored?

In a dedicated secret store, encrypted at rest, with keys managed outside the application database. Postgres holds only metadata and references; provider tokens and API keys live only in the vault.

Can an agent read a credential?

Not through the proxy: Alter injects the credential into the outbound call and returns the provider's response. Agent keys can be issued proxy-only, which makes the proxy the only path. Retrieving a raw token requires a key that was explicitly granted the token-retrieval scope.

Are credentials ever written to logs?

No. Plaintext credentials are kept out of logs, and each key is isolated from every other.

Policy and approvals

What can policy restrict?

Policy is default-deny and evaluated on every call. Rules cover endpoints and methods, source IP ranges, time windows, per-agent quotas, and conditions on request parameters, such as an amount above a threshold or a recipient outside a domain. A rule can deny the call, redact fields, or hold it for approval. If a policy cannot be evaluated, the request is denied.

Who approves a risky call, and what do they see?

A named approver from the application's identity provider. The pending request is frozen and runs only after approval; the approver sees a redacted summary of it (method, host, path, provider, grant, and the operation or parameter values the policy evaluated), never raw bodies or credential-bearing headers. Approval links are sent by email when the policy enables it, or surfaced to the application to deliver. An optional AI risk review can flag unusual calls for approval; it is off unless an organization turns it on.

Can access be time-boxed?

Yes. Grants and delegations can carry an expiry, a delegation can only narrow what it inherits, and time-window rules limit when calls are allowed. Alter does not run just-in-time elevation requests.

Audit and visibility

What is recorded?

Every credential access, policy decision and proxied provider call, on success and on failure. Each row carries the identity and correlation context present on the call, such as the organization, application, end user, agent and trace, and a denial names the policy that fired.

Can the record be altered?

Audit rows are append-only, blocked from updates at the database layer, and carry content hashes that an integrity check verifies.

How long is it kept, and can we get it out?

Retention is an organization-wide window: the plan sets a minimum and any maximum, and admins can extend it within that range. Legal hold keeps records for active matters. Events stream to a SIEM over OCSF or a Splunk-compatible endpoint, and any scope and time range can be exported.

Identity and revocation

How are agents identified?

Each agent is its own principal with its own keys and scopes. When an agent acts for a person or through other agents, the whole delegation chain is resolved before the call and recorded with it.

How fast can access be revoked?

An agent, a key or a single grant can be revoked immediately from the dashboard or the CLI. End users can revoke their own connections. With identity-provider webhooks enabled for Okta, Auth0, WorkOS or Clerk, deleting or suspending a user revokes their access in real time; scheduled directory sync, every six hours, catches anyone a webhook missed.

How do Alter's own administrators sign in?

The operator portal requires multi-factor authentication, with email or Google and GitHub sign-in. SAML single sign-on for the operator portal is not available today.

Deployment and compliance

Where does Alter run?

Either in Alter's managed cloud or on-premises in your own environment. Talk to us to plan an on-premises deployment.

What is Alter's compliance status?

A SOC 2 audit is in progress. The trust center publishes monitored controls and the most recent independent penetration test, and security policy documents are available there on request.

Runtime enforcement: the ten evaluation questions

The questions analysts use to evaluate agentic runtime identity security, answered Yes, Partial or No. Read the framework (opens in a new tab).

Which agents exist, and who owns them?

Partial. Every registered agent belongs to an application in your organization and is listed with its status and scopes. Alter does not discover agents that never registered, and does not assign each agent a named human owner.

Whose authority does each agent use?

Yes. Every call resolves the grant it runs on, the person or organization that owns that grant, and the full delegation chain the agent reached it through.

Which APIs, SaaS applications, MCP servers and data can it reach?

Partial. Each grant is tied to one provider, and endpoint and parameter policy bounds what the agent can call with it. Alter does not inventory the MCP servers or tools an agent can reach.

Can access be scoped, short-lived and revoked?

Yes. Keys and grants carry scopes, grants and delegations can expire, and an agent, key or grant can be revoked immediately.

Can a live action be checked against the task it was meant to do?

Partial. For proxied calls, policy checks each action's endpoint and parameters, and an opt-in AI risk review rates what a request would change and can require approval. Alter does not compare actions against a declared task.

Can it detect intent drift or risky chains of tool calls?

No. Alter evaluates each call on its own and does not score sequences of actions.

Can it block, pause, restrict or revoke an action before it completes?

Yes, for calls routed through the proxy: Alter sits in their request path, so a call is denied, has fields redacted, or is held for approval before it reaches the provider. When an SDK retrieves a token and calls the provider itself, access checks apply when the token is issued and the provider call is recorded, but Alter cannot hold or redact it.

Can the action chain be reconstructed for audit and incident response?

Yes. Each audit row records the context available for that event, such as the decision, the policy behind it and any delegation chain, and the log can be viewed by agent and by trace, then exported or streamed to a SIEM.

Can policies be simulated before they are enforced?

Yes. The policy simulator in the dashboard and the CLI dry-runs a rule against a sample request before it is saved.

Does it support the organization's mix of agent environments?

Partial. Official SDKs cover Python and TypeScript, with guides for FastAPI, LangChain, MCP, Express and Next.js, plus a CLI. Other languages have no official SDK today.