Built to be distrusted.
Short-lived authorizations, offline verification, default-deny policy, and an append-only record that includes denials.
Signed, expiring, checked without us.
Every authorization an agent carries is a short-lived Ed25519-signed token. Anyone downstream can verify it against our published signing keys.
Short-lived authorizations
Ed25519-signed authorization tokens expire in minutes. Device signing keys are generated locally, never leave the device, and can be revoked centrally.
Verify without calling us
Downstream systems check signatures against our published JWKS: no API call on the hot path, no callback to us.
Fails closed
An expired token, an unknown key, or a missing rule all mean the same thing: the call doesn't happen.
Downstream credentials stay server-side.
Sealed vault
Credentials are AEAD-encrypted at rest with one write path and one decrypt path. They are not persisted in plaintext.
Server-side only
Org-provisioned credentials are decrypted only when needed and used in-process to forward the call. They never reach a device; the device only signs the request.
Revocable
Per-user tokens are brokered and revocable at any time; org credentials rotate without touching any employee's setup.
Compromise one device, not every downstream system.
A compromised device can attempt only the scopes policy allows, using a revocable signing key. It does not reveal the underlying credentials for connected systems, and its attempts are recorded.
A constrained foothold
A compromised device exposes a revocable signing key, not the underlying credentials for every connected system.
Authorizations expire in minutes
Previously issued authorizations have a short lifetime, limiting how long any captured token remains useful.
One revoke ends it
Revoke the device in the dashboard and every key on it stops working immediately.
Attempts leave tracks
Every call it tried, allowed or denied, is already in the append-only ledger.
Append-only, allow and deny alike.
Two ledgers back every claim on this page: an action ledger with every signed call and every denial (actor, agent, action, resource, and the identity used), and a governance ledger with every change to the rules themselves. Neither can be edited after the fact.
Action ledger
Who did what, as which identity, and whether policy allowed it. Denials are first-class records, not missing rows.
Governance ledger
Rule edits, grants, credential rotations, device pairings, each with the human who made the change.
Streams to your SIEM
Both ledgers export as three versioned streams — decisions, governance changes, sessions — over HMAC-signed webhooks or Splunk HEC. Ordered, at-least-once, minutes behind live.
What we haven't built yet.
We'd rather tell you than have you find out. These are planned, not shipped:
- Key custody in KMS/HSM
- Directory sync (SCIM)
- DPoP sender-constrained tokens
- Self-hosted deployment
Found something? We want to know: hello@trytiertwo.com
Give your agents an identity you control.
Self-serve and free while in beta. Start with one agent and one connection.