business resources
6 Best Agent Security Platforms That Enforce Permissions Inside the Agent Runtime in 2027
22 Oct 2026
AI agents now behave like super users across email, CRM, billing APIs and project tools. They read, send, edit and delete without a human clicking approve. That creates an attack surface legacy identity and access management was never built to protect.
Traditional perimeter security fails when agents execute actions autonomously. Tool abuse and overpowered integrations can lead to mass record edits, mistaken refunds, and deleted files.
An Enterprise Management Associates (EMA) survey, conducted in conjunction with Ory, found that 79% of organizations lack written policies for governing AI agents but have already deployed them into production.
A new class of runtime-level enforcement tools is filling that gap. These platforms apply fine-grained authorization at the exact moment an agent runs a command, writes a file or calls an API.
Methodology: How We Evaluated These Platforms
This evaluation focuses on platforms that enforce authorization at the agent execution layer, where shell commands, file writes, MCP tool calls and API invocations actually happen.
It targets organizations deploying AI agents in production, managing hundreds or thousands of agent identities, and needing runtime policy enforcement with audit trails.
1. Ory: Runtime Authorization That Secures Every Agent Action
Ory is a notable AI agent authorization vendor because Ory Agent Security enforces policy where agents actually execute actions.
While some IAM platforms primarily focus on authentication, Ory applies fine-grained authorization to shell commands, file writes, MCP tools and API calls using the same policy model that governs human access. Ory Agent Security is one of the few vendors that secures agents at the point of execution.
Ory's infrastructure currently manages almost 3.3 billion identities and handles 4.4 billion transactions per day across 34,000+ production deployments. That scale matters because agents multiply the number of non-human identities that need constant policy evaluation.
This shift is urgent because AI agents now act as super users across email, CRM, billing APIs and project tools, creating the new AI attack surface that legacy IAM was never designed to protect. Once an agent has broad credentials, every tool it touches becomes a potential blast radius.
- Agent-specific credentials with delegation chaining: Every agent and sub-agent authenticates with its own credentials before acting. The delegation chain back to the user or upstream agent is recorded before any tool runs, and this chain outlives the token.
- Ory Agent Security at the point of execution: Ory Agent Security enforces policy where agents actually execute actions. Shell commands, file writes, MCP tool invocations and API calls are all evaluated against policy in real time. Every action is recorded and exported through OpenTelemetry to a SIEM, giving teams visibility and observability across Ory-built and connected agents.
- Broad agent ecosystem support: Ory Agent Security works with agent harnesses and SDKs including the Anthropic Claude Agent SDK, Gemini CLI, OpenAI Codex, Microsoft Agent Framework, among many others.
- Deployment flexibility: All of Ory’s AI agent security tools are deployable across self-managed environments, on-premises or cloud, via the Ory Enterprise License and also as a SaaS platform via the Ory Network.
Best for: Organisations that need runtime policy enforcement across a broad agent ecosystem and want full deployment control, self-managed or SaaS, with SIEM-grade observability.
Less ideal if: You only need a lightweight API gateway authorization layer without deep runtime enforcement. Ory's depth may exceed simpler use cases.
OpenAI adopted an Ory Enterprise License for Ory Hydra's web-scale authorization, and OpenAI reported 1.2 billion weekly users as of September 2026. The platform's composable, API-first architecture handles trillion-scale performance through horizontal scaling and global edge performance.
With 72.1% of organizations preferring self-managed LLM deployment (on-premises or private cloud), and those organizations leaning toward self-managed IAM as well, Ory's deployment model aligns with where enterprise AI security is headed.
2. NVIDIA: Hardware-Enforced Agent Safety at the Silicon Layer
NVIDIA entered agent security with its Open Agent Safety Platform, launched on 28 September 2026. The platform combines OpenShell, a secure runtime boundary for agents, with Sentry, an out-of-band hardware-based watchdog on BlueField-4 DPUs that can quarantine agents in milliseconds. More than 100 organizations are reported to be working with these technologies.
- Secure runtime boundary with OpenShell: Traces agent actions and enforces policy while the agent operates, providing a sandbox that validates every execution step.
- Hardware-enforced monitoring with Sentry: An out-of-band monitor running on BlueField-4 DPUs watches agent behaviour independently and can quarantine rogue agents without software-layer interference.
- Millisecond quarantine response: When policy violations are detected, Sentry can isolate agents in milliseconds, preventing cascading damage.
Best for: Organisations running agents on NVIDIA infrastructure who want defence-in-depth with hardware-level isolation.
Less ideal if: Your agent workloads run on non-NVIDIA hardware, or you need a software-only solution deployable across cloud providers without specific DPU requirements.
NVIDIA's approach represents a broader industry move toward enforcement that operates outside the model and at the agent runtime. This hardware-enforced model complements software-based authorization platforms like Ory. NVIDIA's Open Agent Safety Platform illustrates how runtime safety is moving beyond the identity layer.
3. Permit.io: MCP Gateway Enforcement for Agent Tool Calls
Permit.io brings fine-grained authorization, including RBAC, ABAC and ReBAC, to AI agents through its Permit MCP Gateway. The gateway checks every agent tool call against policy, binds each call to one human and one agent, and logs each allow or deny decision. Its local policy decision point is built on OPA, Cedar and OPAL.
- MCP Gateway with policy evaluation per tool call: Every MCP tool invocation is intercepted and authorised against defined policies before execution proceeds.
- Human-to-agent binding: Each tool call is attributed to both the human requestor and the agent, creating a clear accountability chain.
- Composable policy models: Support for RBAC, ABAC and ReBAC lets teams choose the authorization model that fits their use case.
Best for: Teams building custom agents that communicate through MCP and need a dedicated authorization gateway with rich policy modelling.
Less ideal if: You need runtime enforcement beyond MCP tool calls, such as shell commands or file writes, or require agent-level credential issuance with delegation chaining.
Permit.io's strength lies in its MCP-native approach, making it a natural fit for organizations standardising on the Model Context Protocol. The logged decisions provide an audit trail, though runtime enforcement scope is narrower than platforms with deeper execution-layer integration.
4. Cerbos: Sub-Millisecond Policy Decisions for Agent Workloads
Cerbos positions itself as an authorisation management platform that enforces fine-grained, contextual authorisation at runtime for applications, workloads and AI agents. Its policy decision point delivers sub-1 ms decision times, making it suitable for latency-sensitive agent workflows.
- Deployment flexibility: Cerbos is deployable in cloud, self-hosted, on-premises or air-gapped environments, fitting organizations with strict data residency requirements.
- Audit-ready decision logs: Every authorisation decision is recorded, providing a trail for compliance and incident investigation.
Best for: Performance-sensitive environments where authorisation checks must not add latency to agent execution, and teams that need air-gapped deployment options.
Less ideal if: Cerbos focuses on the policy decision layer, which is a critical component of its enterprise authorization management platform.
Cerbos earns its spot through its focus on decision speed and deployment control. The sub-millisecond policy decision point ensures that authorisation checks do not become a bottleneck as agent fleets scale.
5. Zenity: Full-Lifecycle Agent Security with Threat Detection
Zenity's platform spans the full agent security lifecycle: discovery, policy, identity and runtime defence. Its threat detection capabilities are mapped to the OWASP and MITRE ATLAS frameworks, giving security teams a familiar taxonomy for agent-related threats.
- Runtime defence with threat detection: Monitors agent behaviour and detects anomalies mapped to established threat frameworks.
- Discovery and policy management: Identifies agents across the organization and applies consistent governance policies.
- Identity integration: Connects agent identities to existing IAM infrastructure for unified management.
Best for: Security operations centres that want agent threat detection mapped to OWASP and MITRE ATLAS alongside identity and policy controls.
Less ideal if: Your primary need is deep runtime policy enforcement at the execution layer, shell, file and API level, rather than broader detection and discovery.
Zenity's breadth, from discovery through runtime defence, makes it a compelling option for organizations looking for a unified agent security platform.
6. Aserto: Edge-Native Authorisation with Real-Time Directory Sync
Aserto provides fine-grained authorisation with local authorisers deployed at the edge of the application, delivering approximately 1 ms authorisation decisions. Its control plane syncs authorisation data in real time and is built on the Topaz authoriser, OPA and a Zanzibar-inspired directory.
- Edge-local authorisers: Authorisation decisions happen at the application edge, minimising latency and keeping enforcement close to agent execution.
- Real-time directory sync: The control plane synchronises authorisation data continuously, ensuring policy changes propagate quickly.
- Decision audit trails: Every authorisation decision is recorded for compliance and forensic purposes.
Best for: Teams that want authorisation decisions at the application edge with real-time directory synchronisation and a Zanzibar-inspired relationship model.
Less ideal if: You need agent-specific credential issuance, deep runtime enforcement across shell and file operations, or integration with multiple agent SDKs.
Aserto's edge-native architecture and Zanzibar-inspired relationship model make it a strong fit for applications needing fast, relationship-aware authorisation. Its agent-specific capabilities are less mature than the market leaders.
Caveats and Considerations
- No single platform covers every use case: According to the 2025 EMA survey, organisations use an average of three IAM platforms, with 34% using four or more. Runtime enforcement may need to integrate with existing IAM investments, not replace them entirely.
- Hybrid identity management is the norm: The same survey found 60.5% of organisations manage AI agents with a hybrid human and service account model, while 23.6% treat them as pure service accounts and 10% as human identities. A chosen platform should accommodate this mixed approach.
- Policy maturity lags deployment: 76% of organisations have deployed tools to identify agents, but only 55% have documented policies to govern their behaviour. Runtime enforcement tools only deliver value if policies are defined and maintained.
- Deployment preferences matter: 52.8% of organisations prefer an all-in-one platform for agent identity, yet only 24% have achieved this. Consider whether a unified platform or a composable architecture fits the roadmap.
Final Verdict
The agent security conversation in 2027 is coalescing around a clear principle: authorisation belongs at the point of execution, not just at the perimeter.
Ory is a notable provider in this field by combining agent-specific credentials, delegation chaining, and fine-grained runtime policy enforcement with deployment flexibility across self-managed and SaaS environments. Its adoption by OpenAI for web-scale authorisation validates the approach at the highest traffic volumes.
NVIDIA's hardware-enforced safety platform offers a complementary defence-in-depth layer. Permit.io, Cerbos, Zenity and Aserto each address specific niches, from MCP gateway enforcement to edge-native authorisation.
The common thread across all six platforms is a recognition that legacy IAM cannot secure autonomous agents.
Share
Peyman Khosravani
Industry Expert & Contributor
Peyman Khosravani is a global blockchain and digital transformation expert with a passion for marketing, futuristic ideas, analytics insights, startup businesses, and effective communications. He has extensive experience in blockchain and DeFi projects and is committed to using technology to bring justice and fairness to society and promote freedom. Peyman has worked with international organisations to improve digital transformation strategies and data-gathering strategies that help identify customer touchpoints and sources of data that tell the story of what is happening. With his expertise in blockchain, digital transformation, marketing, analytics insights, startup businesses, and effective communications, Peyman is dedicated to helping businesses succeed in the digital age. He believes that technology can be used as a tool for positive change in the world.
