Control what every AI agent can access.
Tier Two puts identity, policy, and just-in-time approval between Claude Code or any MCP agent and your internal systems, then records every allow and deny.
As the employee allowed by policy
dana@acme.com · linked Metabase seat · existing permissions preserved
As the organization allowed by policy
@org credential · forwarded server-side · never reaches this device
Just-in-time accessapproval pending
admin.refresh_schema · fresh approval requested for this use
One governed call, three access paths selected by policy.
Your agents already have credentials. You just didn't issue them.
Coding agents and MCP-connected assistants are calling your internal tools today, with API keys pasted into config files and OAuth tokens no one tracks. There's no directory of agents, no policy on what they can do, and no record of what they did.
No approval, no policy, no record. The credential is the only control.
Every call runs as a governed identity, and the ledger keeps the receipt.
A control plane your team can actually operate.
Write policy in plain language, route sensitive actions to a human, and inspect every allow and deny from one place. These are the same surfaces your administrators use after sign-up.
Policy / Metabase
Finance data access
Allow Finance agents to query datasets tagged finance using each employee's linked identity.
Refresh the production schema
research-agent · requested by Dana · one use
query_dataset
Dana · research-agent
refresh_schema
Dana · research-agent
drop_database
Build agent
One agent. Three governed ways to access your systems.
As the employee
Where an employee has their own seat, the agent runs on their credential (brokered OAuth or a linked key), so downstream permissions stay exactly theirs.
As the organization
Where employees don't have individual seats, admins provision one organization credential per connection. Calls are forwarded server-side, so the credential never reaches a laptop.
Just-in-time access
When an agent needs a sensitive action, it requests access for that specific use. An authorized approver grants it, the authorization expires quickly, and the full decision is recorded.
Tier Two decides, and records, which identity every agent call runs as.
From sign-up to governed agent in an afternoon.
- 1
Create your org & enroll agents
Install the Tier Two Client per machine, or push it by MDM for a fleet. Every agent is bound to a human owner; devices can be revoked.
- 2
Add connections
Register the tools agents may reach; choose per-user or org-provisioned credentials per connection.
- 3
Write policy in plain rules
Default-deny. The editor describes every rule in prose and lets you simulate before you ship.
- 4
Approvals where they matter
One-time human approvals or standing grants, routed to the owner.
- 5
Audit everything
Allowed and denied calls alike, with actor, agent, action, and the identity used.
The controls your security review will ask about.
Default-deny policy engine
Nothing runs unless a rule allows it. Rules match by connection, tool, and resource; the most specific rule wins.
Approvals & standing grants
One-time approvals for sensitive actions, standing grants for routine work. Requests route to the responsible owner or team.
Two append-only ledgers
An action ledger that records denials too, and a second ledger for every change to the governance config itself. Both stream to your SIEM.
Agent directory, sessions & health
Every agent in one place: who owns it, what it's connected to, its live sessions, latency, and denied-call trend.
Device pairing & instant revoke
Agents sign from paired devices. Lose a laptop, revoke the device, and every key on it stops working.
Trust-gated access
Policy can require an org-managed, recently-seen device. Managed is earned — enrollment through an admin-minted secret or MDM, plus a live posture heartbeat — not self-declared.
Drops into any MCP host.
Claude Code, Codex, or anything that speaks MCP. Install the Tier Two Client once per machine, or drop the server into any host config. Your agents get two tools; your org gets the ledger.
{
"mcpServers": {
"tiertwo": {
"command": "npx",
"args": ["-y", "@tiertwo/mcp"]
}
}
}Available to beta orgs; pairing starts from your dashboard.
Questions, answered.
What does it cost?
Tier Two is free while in beta. Self-serve sign-up with no card and no sales call. Public pricing will come when billing ships.
Which agents work with it?
Anything that speaks MCP: Claude Code, Codex, Claude Desktop, Cursor, or an agent you built. Install the Tier Two Client and every MCP host on the machine is covered; on Windows, or without the client, npx -y @tiertwo/mcp does the same job.
Can employees sign in with our identity provider?
Human sign-in is handled by Clerk. If your org signs in through an identity provider like Okta, Entra, or Google Workspace, talk to us and we'll set your org up.
Do you auto-provision users from our directory?
Directory sync (SCIM) is on our roadmap; today, membership and roles are managed in Tier Two, and human sign-in supports your IdP at the auth layer.
Where do agent credentials live?
In an encrypted vault on the server. Org-provisioned credentials are only ever used server-side: the gateway forwards the call, so the credential never reaches a laptop. Per-user tokens are brokered and revocable at any time.
Can we stream the audit trail to our SIEM?
Yes. Both ledgers export to a destination you configure: an HMAC-signed webhook you verify like a Stripe signature, or Splunk HEC. Three versioned streams — decisions, governance changes, and sessions — arrive in order, at least once, on a roughly five-minute cadence. Test-send and secret rotation are built in.
Give your agents an identity you control.
Self-serve and free while in beta. Start with one agent and one connection.