Saviynt expands identity security for AI solution with intent-aware runtime authorisation for AI agents
Saviynt released major enhancements to its Agent Access Gateway, a runtime authorisation layer that controls what AI agents can do as they interact with applications, data, APIs, tools, infrastructure, and other agents.
As enterprises move AI agents from experimentation into production, security teams face a new access problem. Agents can reason, adapt, and execute thousands of actions across business systems within seconds. Traditional access controls, which were designed for human users and static applications, cannot always determine whether an agent’s action is appropriate the moment it occurs.
Saviynt’s Agent Access Gateway addresses this challenge by enforcing policy at runtime. Today’s release introduces Intent-Aware Runtime Authorisation (IARA), a new capability that evaluates AI agent actions in real time based on identity, context, policy, and intent. If an action falls outside approved boundaries, Saviynt can block it and generate an audit event at runtime. With IARA, organisations can protect sensitive resources from unintended or unauthorised actions.
“AI agents are becoming a new class of enterprise identity — autonomous, powerful, and capable of taking action across critical business systems,” said Vibhuti Sinha, Chief Product Officer, Saviynt. “Agent Access Gateway gives enterprises a way to control AI agent behaviour at runtime, when decisions actually happen. With IARA, organisations can move beyond static permissions and make access decisions based on what an agent is trying to do, why it is doing it, and whether that action should be allowed.”
Along with IARA, Saviynt also announced expanded capabilities within its broader Identity Security for AI solution to help organisations address identity governance and security posture across the entire AI ecosystem. Agent Access Gateway now enables organisations to:
– Evaluate AI agent actions at runtime, in real-time, based on identity, context, policies, and intent
– Control an agent’s access to tools at runtime using static and dynamic policies
– Determine who an AI agent acts for by recognising whether it carries out actions independently, on behalf of a human, or via another AI agent.
As AI agents increasingly interact with humans and other agents, governance should apply to every access. For example, a sales operations agent may be authorised to access CRM data to summarise a customer opportunity. But if that agent then attempts to export customer records, modify pricing terms, or trigger outbound communications, the critical question is whether those actions match the user’s original intent — not simply whether the agent is technically authorised to perform them. Saviynt’s intent-aware runtime enforcement is designed to identify that mismatch at runtime and prevent the action before it occurs.
The latest release also features new inbound and outbound access controls for AI agents, bringing identity governance principles to autonomous systems. Organisations can now govern who is authorised to interact with AI agents and what applications, data, and resources those agents are permitted to access. This enables enterprises to enforce least privilege, strengthen accountability, and reduce the risk of unauthorised AI actions at scale.
Saviynt’s Identity Security for AI control plane enables AI agent visibility, management, governance, and access across every layer of the stack – where they’re built, where they run, and the enterprise applications where they take action. The latest release extends Saviynt’s ecosystem of native integrations to include Microsoft Foundry, N8N, Snowflake Cortex, and more.
Additionally, Saviynt introduced new identity verification capabilities to help organisations reduce impersonation risk as AI assistance makes fraud, social engineering, and unauthorised access attempts easier to execute. New capabilities also provide high-assurance identity verification directly within the Saviynt platform for human identity certification, including biometric scanning, selfie photos, liveness detection, and support for more than 4,000 government-issued document formats across more than 177 countries.
Together, these capabilities help organisations address two of the most urgent AI-related security challenges facing enterprises today: controlling agent access at runtime and reducing identity impersonation risk.