Adaptive security for AI agents
Security that knows when to act.
Integrated into your systems.
We’re building security that adapts to how agents work, keeping routine activity moving and stepping in when risk changes.
Permission is only part of the picture.
Access tells you what an agent can do. Context helps determine whether a particular action should proceed, needs verification, or crosses a boundary.
The actor
The agent taking the action.
On whose behalf
Who the agent is acting for, and with what delegated authority.
Where it’s running
The device, session, or execution environment.
What’s at stake
The sensitivity of the resource and the proposed action.
What came before
Recent behavior and the sequence of activity.
Too much access creates exposure. Too many interruptions slow everyone down. Better security needs to understand the difference.
Same access. Different context.
Illustrative product preview
A familiar session reads several documents in an approved workspace.
Actor
Assistant agent
Acting for a product manager · Familiar session
Action
Read a document
Approved workspace
Session so far
- Opened planning notes
- Read the project brief
- Read the vendor summary
- Now Read a document
Context
- Access
- Delegated read access
- Session
- Established, familiar
- Resource
- Approved workspace
- Sequence
- Consistent with recent work
Decision
Allow
Authorized activity consistent with the session’s expected context.
No prompt. The work keeps moving.
Low risk never adds access.
Context can’t grant a permission an agent doesn’t have.
A deny stays a deny.
Risk assessments don’t override explicit restrictions.
Verification isn’t approval.
One confirms who is acting. The other is a decision by someone authorized to make it.
Like fraud protection. For the way work gets done.
A series of ordinary transactions should not interrupt your day. An unusual pattern should trigger the right check. We believe access to company systems should work the same way.
The goal is not more prompts. It is better judgment about when one is needed.
An ordinary pattern
The same count, a different pattern
Security should build. Not just prescribe.
The best controls are built into the systems where work happens. We believe security teams should build alongside infrastructure and platform teams, and take responsibility for making protection work.
Act is being built to carry the integration, adaptive decision-making, and ongoing tuning that this approach requires.
The work Act is being built to carry
Integration
Direct connections to the systems where work happens. A control only exists where it is connected, so this is the work, not a setup step.
Decisions
Contextual signals weighed action by action: who is acting, for whom, from where, on what, and after what.
Enforcement
Outcomes that take effect: allow, verify, route for approval, or deny. Not alerts waiting for someone to respond.
Ongoing tuning
Continuous adjustment as systems and work change, so that each check stays worth asking for.
Yours to keep
- Your requirements.
- Your hard boundaries.
- Your judgment and accountability.
People delegate. Agents act.
Agents can take more actions, across more systems, with less direct supervision. Broad permissions become more consequential. Approval for every step becomes less practical.
Useful autonomy needs controls that adapt to the action and its context.
A person, working directly
The same person, through agentsIllustrative
Let good work happen.
We’re looking for design partners who want stronger security for their agents, without making every action an obstacle.
meng@act.inc