IDENTOS is attempting to solve the escalating security gap between traditional identity management and the rapid deployment of autonomous AI agents within the enterprise. By launching PolicyArc, the Toronto-based identity and authorization firm is positioning itself to address a critical vulnerability: the tendency for organizations to grant broad, standing permissions to non-human entities. As companies integrate AI agents that pull data and execute decisions, the company is offering a centralized authorization layer designed to enforce scoped, time-limited access. This move targets the specific risk of "reckless" agent permissions, aiming to provide security and compliance teams with a unified mechanism to define, enforce, and audit access across diverse application ecosystems.
Addressing the AI Access Control Gap
The strategic motivation behind PolicyArc stems from a documented deficiency in current enterprise security postures regarding artificial intelligence. According to the IBM and Ponemon Institute's 2026 Cost of a Data Breach Report, 92% of organizations that experienced an AI-related breach lacked proper AI access controls. IDENTOS is targeting this specific vulnerability by moving away from traditional models that primarily grant broad, standing access. While such models may suffice for human users, the company suggests they are inadequate for AI agents that require highly granular, ephemeral permissions to operate safely within sensitive environments.
PolicyArc functions as an authorization layer that allows users to delegate a scoped, time-limited version of their own access to an AI agent. This ensures the agent possesses only the permissions necessary for a specific task, which are then automatically revoked once the task or time window concludes. Furthermore, the platform is designed to move beyond simple login-based checks. Instead, it seeks to enforce consent on every individual request, verifying access against what the data owner has specifically agreed to in real-time. This approach aims to mitigate the risks associated with agents acting on behalf of users without continuous, context-aware oversight or granular permissioning.
PolicyArc Technical Capabilities and Deployment
The technical architecture of PolicyArc focuses on real-time, context-aware decision-making and centralized policy management. Rather than relying solely on static attributes like a user's role, the platform integrates standing facts—such as identity verification status—with real-time environmental context, including resource sensitivity and current workflow stages. This allows the system to dynamically allow, deny, or trigger additional verification requirements at the moment an access request is made. This capability is intended to provide a more responsive security posture than traditional, slow-to-change access policies.
For enterprise engineering and compliance teams, the platform offers a centralized environment to manage access across an entire ecosystem. IDENTOS claims that a single policy definition can be applied consistently across all connected applications, allowing new resource types to be added without requiring the rewriting of existing integrations. This is intended to ensure that access rules can scale alongside product development. Additionally, the platform includes built-in auditing, where every access decision is automatically logged. This is positioned as a way for compliance and risk leaders to maintain continuous evidence of appropriate access, rather than attempting to reconstruct audit trails after a security event or during a regulatory review.
Key Takeaways
- IDENTOS has announced the general availability of PolicyArc, a centralized authorization platform for people, services, and AI agents.
- The launch addresses a security gap where 92% of organizations experiencing AI-related breaches lacked proper AI access controls, per IBM and Ponemon Institute data.
- PolicyArc enables "scoped, time-limited" access, allowing AI agents to inherit specific permissions that are automatically revoked upon task completion.
TechInsyte's Take
In our view, the launch of PolicyArc signals a fundamental shift in the identity and access management (IAM) landscape, moving from "who are you" to "what is this agent allowed to do right now." As enterprises move past simple LLM chatbots toward autonomous agents capable of executing workflows, the attack surface expands exponentially. IDENTOS is correctly identifying that the primary risk is not just identity theft, but "permission creep" where non-human entities hold excessive, permanent authority. By focusing on ephemeral, context-aware authorization, IDENTOS is attempting to build the necessary guardrails for the next phase of enterprise AI adoption. If the platform can successfully deliver on its promise of centralized, real-time policy enforcement without introducing significant latency into AI workflows, it could become a foundational component of the modern, AI-integrated digital infrastructure.
Questions & Answers
How does PolicyArc mitigate the risks associated with autonomous AI agents?
PolicyArc addresses these risks by replacing broad, standing permissions with scoped, time-limited access. This allows an agent to inherit only the specific permissions required for a single task, which are automatically revoked once the task is complete, preventing the agent from maintaining unnecessary or permanent access to sensitive data.
What role does real-time context play in PolicyArc's authorization decisions?
Unlike traditional systems that rely on static roles, PolicyArc combines standing identity facts with real-time context, such as the sensitivity of the resource being accessed or the current stage of a workflow. This enables the platform to make dynamic decisions to allow, deny, or request extra verification at the moment of the request.
How does the platform support enterprise compliance and auditing requirements?
PolicyArc is designed to provide an automatic audit trail by logging every access decision by default. This allows compliance and risk leaders to access reportable evidence of appropriate access from the outset, rather than having to reconstruct access history after the fact for regulatory or internal reviews.
Can PolicyArc scale as an organization adds new applications or resource types?
The company states that PolicyArc allows users to define a resource type once and apply that policy consistently across all connected applications. New resource types and policies can be added without the need to rewrite integrations, which is intended to allow access rules to keep pace with evolving product surfaces.
Source: IDENTOS
