simfinii

We take into account multi agent hops. Currently we account for multi agent hops with a depth of 8 agents.

Each agent can delegate a subset of its permissions. So if agent A started with the users permissions, it can delegate all of user A's permissions or a subset of user A's permissions.

In your case specifically the agent can delegate part of the permissions it has to the other agent to do part of the job. It can be as granular as you want it and its fully audited!

Hey Hafiz! Exactly. Its a real problem with multi user agents. We solve the shared API key problem by taking into account end user identity and the agent identity.

We have seen this explicitly become a problem for agent deployments like the ones you described. A lot of our initial users have built multi user, multi channel agents and need to keep track of end user identity through out that interaction. If you are interested in using alter for your concierge agents let us know! Would love to help out and onboard you ourselves.

We integrate with IDPs and allow agents to send little sign up links within chat interfaces so your agent can know exactly who its chatting with and enforce end user permissions and memory segregation

Hey! Great question. So here when we say nobody can read them back we mean no user/developer can read them back. During the time of the request the backend code retrieves the credential from the vault and auto injects it in the request path.

We will be open sourcing our codebase soon so you can examine the code yoursef!

Please feel free to do so

We are open sourcing the full platform soon so you will be able to inspect the the code.

Regarding SOC2, in the process of getting SOC2, Type 2 compliant. As you may know there is 3 month waiting period before the auditors give a SOC2 certification so currently in the waiting period for that

Hey! Fair question.

We are currently in the process being fully SOC2 compliant and have gotten pen tested twice from two different companies and have found no issues. You can explore the full extent of our security process and pen test results here : trust.alterauth.com

Separately would say it is a bad assumption to make that a product is vibe coded without trying it out. As mentioned in the post we adopted a lot of security processes as a part of our SDLC including consistent scans for supply chain attacks, and static code scanners (SAST).

We also do a pen test at a yearly cadence

Great question! If you are looking to just store secrets you can just use infisical.

The real value of alter comes in when you want to give your agents access to end users credentials. When agents act on behalf of end user as a developer you have to manage multiple credentials and more importantly manage the mapping relationship between end user identity and the credentials.

Also, as agents take actions the problem of non deterministic actions become more pronounced. With alters policy guardrails any chance of actions taking negative actions is mitigated.

Lastly, the full compliance trails of what the agent has done ends up being quite valuble especially as agents take more autonomus actions!

LOL that was a polite response to a rude question. There was no LLM involved there

Thank you!

Thank you! Yes the goal is to allow developers to build multi-tenanted agents that can actually act on behalf of end users. We are in the process of abstracting away every building block needed to build that so developers can focus on what they do best

Yes we do. We separate based on both the end user identity and agent identity. Would love to see how your product could potentially work with alter