Scoped, expiring credentials for agents
Your agent has a key that opens everything
Agents get handed a long-lived token with every scope the team could think of, because issuing anything narrower means guessing what the agent will need. Keyring watches what it actually uses and tells you when it is safe to take the rest away.
The problem
Nobody grants least privilege to something whose behaviour they cannot predict
The reason your agent holds customers:delete is not carelessness. It is that a scope removed too early breaks a task at 2am, and nobody can prove in advance which scopes a language model will reach for. So the token gets every scope, forever, and the blast radius of a prompt injection becomes the blast radius of the whole integration.
The insight
The question is not which scopes were used. It is whether you have watched long enough
Taking a scope away is only safe if you are confident no rare task needs it. That is not a set-union question, it is a missing-mass question — the same one an ecologist asks about species they have not caught yet. Good-Turing answers it directly from the trace: the share of scopes seen exactly once estimates the probability that the next task needs one you have never seen. When that number reaches zero, tightening is safe, and Keyring tells you the day it does.
Set-cover over observed tool calls for the minimal scope set, weighted by blast radius rather than count, with a Good-Turing estimate of unobserved-scope probability to decide when the observation window is long enough to act on.
How it works
Four steps, no data science team
Keyring sits between your agent and its tools, so it sees every scope exercised without changing the agent.
It reports the probability that a scope you have never seen is still needed. You act when that reaches zero, not when you get impatient.
Each task gets a token scoped to what that task type actually does, expiring when it finishes.
Every issued credential and every scope it touched, in a form an auditor can read.
Who it is for
The engineer who owns the agent, and the person who signed off on it
Teams running agents against production systems with real write access. Usually past the demo stage, usually after a security review asked a question they could not answer.
Pricing
- –Scope observation
- –Over-grant report
- –Missing-mass estimate
- –Per-task credentials
- –Automatic expiry
- –Audit trail
- –Slack alerts on new scope use
- –Self-hosted
- –SSO and SCIM
- –Break-glass workflow
- –Export to your SIEM
Competition
What exists, and what it does not do
| Who | What they do | The gap |
|---|---|---|
| Vault, AWS STS, Workload Identity | Issue short-lived scoped credentials to services. | They will issue any scope you name. Naming the right one is the entire problem, and nothing in the stack tells you what an agent actually needs. |
| Agent frameworks | Let you configure which tools an agent may call. | Configuration is per-agent and static. It has no idea which of the configured tools this particular task will use. |
| CIEM and cloud permission tools | Right-size IAM roles from CloudTrail usage. | Built for humans and services with stable behaviour, at cloud-resource granularity. An agent task is a different unit and moves far faster. |
| A long-lived token in an env var | What almost everyone does today. | Cannot be scoped without breaking something, cannot be rotated without a deploy, and turns any injection into a full compromise. |
The obvious people to build this are the agent frameworks and the cloud providers, both of whom already own a piece of the path. The defensible part is the observation layer — knowing when it is safe to tighten — not the issuing, which is commodity. If teams decide they would rather over-grant and monitor than under-grant and page someone, this becomes a report nobody acts on. The second risk is that it sits inline: a credential broker in the request path has to be more reliable than the thing it protects, and that is a real operational bar for a solo founder to clear.
Market
Priced against the security budget that already funds secrets management, not as a new agent line item
Every team that puts an agent in front of a system that can write is a candidate, and the security review that precedes that launch is the forcing event. Two thousand teams at the Team tier is $14M ARR; the Scale tier is priced against the incident it prevents.