MonoCloud for Startups - One identity layer for your customers, APIs, and agents
MonoCloud is one identity layer for your customers, your APIs, and your agents. Most tools stop at a login box. We go past login into authorization and accountability: decide exactly what every user, service, and AI agent can access, prove what it did, and revoke it in an instant. Fine-grained Cedar authorization, passkeys and SSO, API protection, M2M, and mTLS with certificate-bound trust, all on one platform. Startups get the full platform free for one year.
Replies
First of all a great congrats to @riya_pariyar @roguetink @maganuk
I am just curious that you've said you're building the auth layer for agentic products "from the ground up" instead of bolting agent support onto human auth. Concretely, what does a token look like when an agent calls another agent three steps downstream? How do you actually scope and audit that so the blast radius doesn't become "every permission that token ever carried"?
MonoCloud for Startups
@arduvey29 Thanks! A token never inherits permissions, it's decided fresh at every issuance under default-deny, and you can forbid a sensitive API from ever sharing a token with others, so a token can't quietly widen to reach something it shouldn't. Tokens issued over mTLS, including X.509 SVIDs, are certificate-bound, so a copy is useless without the matching cert. If you want to see how that's written, there's a full guide with example policies at monocloud.com/docs/guides/api-access-policy
Everything in the thread assumes a human kicked the agent off. A good chunk of what I run is on a cron, hourly, nobody logged in, so there is no session to ride along as context.user, and that is exactly where "on behalf of" gets slippery: the agent is acting for an intent someone wrote down three weeks ago, not for a person who is awake to notice. Does that shape get its own principal, or does it collapse into a machine client with a service identity and you lose the delegation trail?
MonoCloud for Startups
@dipankar_sarkar When there's no human, there's no user in the request. Machine-to-machine grants carry no user context, so the agent authenticates as its own principal, an agent client or a SPIFFE workload, not an anonymous session, and what it's allowed to do is set by policy on that identity. The grant-type and context detail is all written up here if you want it, monocloud.com/docs/guides/api-access-policy
Dial
the instant-revoke plus proof-of-what-it-did combo is the part that actually matters once agents are calling real APIs on someone's behalf. most identity providers treat agents like just another OAuth client and call it done. does the audit trail capture the actual reasoning/prompt context behind an action too, or just the API call itself? that distinction matters a lot when you're trying to explain after the fact why an agent did something unexpected.
MonoCloud for Startups
@omri_ben_shoham1 We audit the identity layer, and it's fairly detailed, the principal that acted, the mTLS and trust store context, and the policy evaluation itself, including whether the decision was allow or deny and why, for example a revoked certificate. What it doesn't capture is the model's prompt or reasoning, and that belongs in your agent or observability layer. You join the two by the agent's identity to explain why it acted.
Macaly
one layer for users + agents is smart 👏 auth is def heading this way
MonoCloud for Startups
@petrkovacik Thanks Petr! Agreed, once agents started acting for users the split between "user auth" and "machine auth" stopped making sense. Curious how you're handling it at Macaly, are the apps people build getting agent access into their stack yet?
Lessssgooooo MonoCloud
The customers/APIs/agents split is a nice framing. When I’ve seen auth projects drag, migration is usually the painful part. Do startups get a path to adopt one surface first, or is it meant to replace the stack in one go?
MonoCloud for Startups
@xiaosong001 Yes, one surface first is exactly how it's meant to go, no big-bang replacement. Because it's standard OAuth and OIDC, MonoCloud runs alongside your current setup, so you can start with a single piece, customer login, or just your API auth, or only the agent side, and expand from there. Users come across programmatically through our Create User endpoint, carrying their claims plus private and public data, so you're not rebuilding profiles.
And if you're early, I'd point you to our startup program. You get the full platform free for a year with all premium features, and our team gets hands-on with the migration so you're not doing it alone. You can fill out the form here, https://tally.so/r/ZjKMKB