Agent Security

Security at the point of execution.

Make agentic AI safe to scale

AI agents are moving fast. Do you know what yours are doing? Ory brings visibility, identity, and control to agent behavior, helping you understand their actions, enforce policies at runtime, and scale with confidence.

Start by observing agent activity at no cost. Add enforcement when you're ready.

Works with the agents, frameworks, and deployment methods you already use

Your agents have credentials. But who's really in control?

AI agents act with legitimate access, often inherited from people and systems. But valid credentials don't necessarily mean an action is appropriate or authorized. Without visibility, organizations may not even know what agents are doing. Agents are relentless. The identity gap is where agent risk becomes business risk.

• Invisible Activity

  Agents and sub-agents operate across tools and systems with limited oversight.

• Borrowed Authority

  Agents may inherit permissions that exceed what their tasks require.

• Uncontrolled Actions

  Approved tools and valid credentials can still enable harmful activity.

What are your agents actually doing?

Turn on the lights. Before you turn on the rules. Because the answer isn't to block everything. Or trust everything. It's to know before you act.

The agent security lifecycle is now complete.

With the recent launch of Build and Deploy, Ory Agent Security now offers commercially available capabilities across the entire agent security lifecycle. Start wherever you like. Continuously improve.

Four interconnected capabilities. One continuous lifecycle.

All available TODAY.

Observe

Turn on the lights. Discover what agents do, whose authority they inherit, and which actions they attempt.

Enforce

Deterministic control for probabilistic systems. Apply fine-grained, identity-aware controls before supported agent actions execute.

Build

Make security part of the agent. Embed identity, permissions, and guardrails into agents using APIs, SDKs, and plugins.

Deploy

Give agents the ability to scale. Safely and under control. Extend consistent security across growing agent deployments, environments, and workflows.

How Ory's agent security works

• Authenticate agent identities — Ory resolves the agent’s identity inside the harness, whether it was started by a human, another agent, or a headless process. Each agent gets its own credentials and audit attribution, so teams can see which agent acted, where it ran, and how it was delegated.

• Apply fine-grained authorization — Before an agent action runs, Ory checks the requested tool against Ory Keto (Permissions). Shell commands, file writes, web fetches, and other harness tools can be enforced through the same Zanzibar-style permission model used for application access.

• Enforcement that fits your risk tolerance — Every agent action hits a decision point before it runs. Observe first, enforce when ready — by category or down to the command. Cut off any agent instantly.

• Observability across agent activity — Every permission check, tool call, and sub-agent start is recorded: who started the session, which agent acted, what it attempted, and which policy decided.

Building agents? Running them in production?

Ory Agent Security gives every agent its own identity, scoped to what it actually needs and revocable. Early adopters run it on Ory Network at no cost. Free coverage for a limited time.

• Authenticated

  Every agent and sub-agent authenticates with its own credentials before acting. The delegation chain back to the user or upstream agent is recorded before any tool runs.

• Authorized

  Ory applies fine-grained authorization to shell commands, file writes, MCP tools, and API calls — the same policy model that governs human access.

• Accountable

  Every action is recorded and exported through OpenTelemetry to your SIEM. The delegation chain outlives the token, so the trail holds even after credentials expire.

Frequently asked questions

How do I secure the developer workflow with Ory?

Ory provides a security plane for AI agents. It plugs into (with plugins, SDKs, and integrations) agent harnesses developers already use, such as Claude Code, Codex, Gemini CLI, OpenClaw, and OpenCode, and brings identity, authorization, and audit controls to agentic coding workflows.

Why do AI coding agents need a dedicated security layer?

AI coding agents can read repositories, run shell commands, write files, call internal APIs, and open pull requests with the developer’s authority. Without a standard way to verify who started the session, control which tools the agent may use, or record what the agent did, organizations face security and compliance gaps.

How does Ory identify who is using an agent?

Every session is designed around two identities: the human user and the AI agent(s) process. The human and agent identities are authenticated and authorized using the same Ory products, while adding new standards and protocols for agentic workflows.

How does Ory control what an agent can do?

Before tool calls are executed, Ory checks permissions using Ory Keto (Permissions). Tool calls are authorized against policies such as whether a specific user may invoke Bash, Read, Edit, or other tools. MCP server access can also be governed with server-level and optional tool-level checks.

Does Ory work with MCP servers?

Yes. Ory adds OAuth 2.1 authorization for MCP servers because MCP tools can expose external tools, resources, and prompts. The system checks whether an agent session may use a given MCP server, and can optionally check individual tools within that server.

What happens when an action is denied?

When permissions explicitly deny a tool call, the plugin blocks the action where the harness supports blocking and traces the denial. If Ory is unreachable, rate-limited, or unconfigured, the system follows fail-open semantics: the tool is allowed and the error is logged.