| TL;DR: An AI agent asked to read database records may also have permission to change them or retrieve sensitive information. Akeyless keeps passwords out of the agent’s hands and checks its requests against security policies before they run. It can block a restricted query while allowing the agent to request permitted data instead. This adds control over how agents use an active connection, beyond deciding whether they can connect in the first place. |
An AI agent asked to summarize sales records only needs to read them. But the database login it uses might also let it change or delete those same records. If the agent misreads an instruction or gets tricked, that login won’t stop it from making those changes.
The challenge is, then, giving an agent enough access to complete its task without allowing it to go beyond those permissions.
Akeyless is addressing that question with Agentic Runtime Authority. Released to all customers on September 9, 2026, it evaluates an agent’s requests after the agent establishes a connection. It builds on its existing protection, which prevents agents from accessing passwords and keys directly. Stopping a risky action sounds simple. After all, the hard part is knowing an action is wrong when the agent’s login says it’s allowed.
An Agent’s Login Often Allows More Than Its Task Needs
The problem is already showing up in organizations. A January 2026 Cloud Security Alliance survey asked 228 of them about agent access. Of those, 74% said agents often received more access than necessary.
OWASP, the application security organization, identifies this problem as excessive agency. Its examples include database connections that allow agents to modify or delete information when their tasks only require read access.
Read-only database permissions remain an essential starting point, since they stop the agent from altering anything. However, that doesn’t address every risk. Oak is tackling the identity side of the same problem, helping enterprises see what agents can access and who remains responsible for those permissions. Read access can still expose sensitive columns, like salaries, that the agent should never see.
For companies evaluating AI agent access control software for enterprise databases, restricting connections isn’t enough. They also need to define which actions and data each task requires, and check whether the software enforces those limits before a request executes.
Akeyless Connects the Agent without Handing Over a Password
Akeyless first controls how an agent connects to a protected system. It then adds another layer of control over the actions the agent can take. SecretlessAI handles this connection, allowing agents to access business systems without receiving passwords or tokens directly.
Instead, the agent connects through the Akeyless Gateway, which provisions a short-lived identity directly on the target system. In other words, this provides credential-free AI agent access, allowing agents to connect to enterprise systems without seeing or holding the credentials used to authenticate them.
That protection pays off when hidden instructions in an email or document manipulate an agent while it is carrying out a task. According to Akeyless, this leaves the attacker without a credential to steal. The connection itself stays open, though, so a compromised agent could still use it to delete records.
Akeyless CEO and co-founder Oded Hareven addressed both risks in the announcement. He described a coding agent that needs credentials to reach cloud resources, and an assistant trusted to honor read-only access. Both, he said, come down to the same question: “Is there one place issuing, governing, and revoking that authority?”
SecretlessAI addresses the credential problem. But keeping credentials out of an agent’s reach doesn’t automatically limit its actions. The same gap appears at the API layer. Salt Security is looking at what agents do after gaining legitimate access, including whether they use that access beyond what the task requires. Preventing an agent from exceeding its permissions requires checking its requests even after it connects.
Which Software Can Block Unauthorized AI Agent Actions Before They Execute?
Agentic Runtime Authority addresses this second problem by evaluating agent requests and blocking those that violate established policies.
NeuralTrust is approaching runtime security from a similar point in the workflow, monitoring agent behavior and tool use as a task unfolds rather than relying only on the permissions granted beforehand. Every request passes through the Akeyless Gateway, where the platform checks it against the organization’s security policies.
Administrators configure rules for both incoming requests and outgoing data. Input rules block restricted queries before they reach the protected system, while output rules filter sensitive information before returning it to the agent.
The company describes this as Intent-based access control for AI agents. By default, an AI model interprets each request and checks whether the requested action complies with the configured policy. An optional setting called AI Quorum brings additional models into the evaluation. If any model flags a request as violating policy, the platform blocks it.
Akeyless’s published demo uses an employee database with restricted salary information. The agent can reach the database but holds no credentials for it.
The agent first requests every column in the employee table. The platform blocks the query because it would reveal salaries. The agent then rewrites its request without the salary column and gets the permitted data back. The block narrows the task instead of ending it.
For buyers, the more important question is whether an agent can retrieve the information it needs without gaining access to restricted data or database credentials. The demonstration shows how the platform can restrict data access even when an agent has an active database connection. Buyers should test the same controls against their own database permissions and actual agent requests.
A Blocked Request Should Leave a Clear Record
Once Runtime Authority stops an agent’s request at the Akeyless Gateway, the risky action never runs. However, that doesn’t mean the investigation ends there. Security teams still need to work out what happened.
The same Cloud Security Alliance survey found that 68% of respondents struggled to distinguish actions taken by AI agents from those performed by humans. Organizations also differed on who should oversee agent identities and access. Only 9% identified identity and access management teams as the primary owners.
When responsibility is spread across departments, security teams need a reliable record of what an agent did and who authorized its actions.
Akeyless says its dashboard displays active agent sessions and allows security staff to terminate them when necessary. The platform also records why it blocked a request and identifies the person or system that initiated each action. These records can also be sent to security monitoring tools such as Splunk and Microsoft Sentinel.
A fair test of AI agent identity security is whether one record shows who authorized the work and which restriction applied. Just as importantly, it should record what the agent attempted, without requiring security staff to piece together logs from several tools.
Runtime Controls Have to Work Across the Tools Agents Already Use
Akeyless isn’t the only vendor checking agent actions before they reach connected tools. AWS has also introduced a policy engine for Amazon Bedrock AgentCore. It checks calls made by agents against predefined authorization rules. Organizations already using this may have access to similar controls within their existing infrastructure.
The company also announced integrations with Claude Enterprise and OpenAI Codex. AgentCore is on that list too, so buyers should examine what these integrations cover and whether they support the workflows used in their environments. For organizations running agents across multiple platforms, the ability to apply the same access policies across environments could make a centralized control layer useful.
Database coverage is another factor buyers should examine. Akeyless documents support for databases including PostgreSQL, MySQL, Snowflake, and Microsoft SQL Server. More importantly, buyers should establish which requests pass through the Gateway and whether another connection could bypass the configured controls.
For buyers comparing AI agent access control software, the practical question is whether those controls cover the systems and workflows their agents actually use. Akeyless applies AI agent runtime security by evaluating requests against configured policies before execution. Ultimately, as agents gain access to more business-critical systems, buyers will need to test whether those boundaries hold without interrupting legitimate work.
