Launch HN: Alter (YC S25) – Access control for multi-user agents

What it claims

Alter is a hosted privileged access management (PAM) service that sits on the request path between AI agents and third-party APIs. Beyond the summary's vault, proxy and audit description, the page states three things relevant to adoption. Its SOC 2 attestation is "in progress", not complete. An independent penetration test was done within the last 12 months. Security policy documents are available on request through a public trust center.

How it works

The page describes how the platform itself is secured:

• Credentials live in a dedicated secret store, encrypted at rest, with keys managed outside the application database.
• Postgres holds only metadata and vault references. Provider tokens and credentials exist only in the vault.
• Authorization fails closed: if a policy cannot be evaluated, the request is denied.
• Ownership is zero-trust: a key grants no capability unless an explicit record names it.
• Keys are isolated per key, and plaintext credentials never appear in logs.
• "Proxy-only" keys can send calls through the proxy but cannot retrieve the credential at all.

flowchart TD
  A[Agent request] --> P{Policy evaluable?}
  P -- no --> D[Deny]
  P -- yes --> G{Grant allows call?}
  G -- no --> D
  G -- risky --> H[Human approval]
  H -- rejected --> D
  H -- approved --> V
  G -- yes --> V[Vault injects credential]
  V --> X[Provider API]
  A -.-> L[Audit trail]
  D -.-> L
  X -.-> L

Each audit entry records which agent made the call, whose access it used, which policy applied and who approved it. Audit records can stream to a customer's SIEM. Revoking an agent, key or grant takes effect immediately. Identity provider (IdP) webhooks cascade offboarding, so removing a user in the IdP removes their grants.

How to use it

The page links six guides with code:

• Calling APIs on behalf of users, covering OAuth, Connect and identity-aware token retrieval.
• Giving an agent its own identity, user grants and audit trail.
• Replacing environment-variable secrets for backend services.
• Building an MCP server that serves Alter-managed credentials to Claude Code as tools.
• Keying agent memory, sessions and channels by verified identity rather than by what the LLM claims.
• Running a multi-user server where the credential never enters the service's process.

The memory guide addresses a specific risk: an agent trusting a user identity asserted inside model output.

Limits

SOC 2 is not yet attested. Teams whose customers require a SOC 2 report should check its current status in the trust center.

The page gives no pricing, no SDK code or method signatures, and no list of the 140 supported providers. It does not say whether a self-hosted deployment exists. It gives no latency or availability figures for the proxy, even though every proxied call depends on it.

Onboarding goes through a 30-minute walkthrough with the founders.