Srikar and Kevan, founders of Alter (YC S25), are building access control for agents that take actions on behalf of multiple users. Their launch addresses a common problem: everyone signs in with their own account in Slack, but the agent connects to systems like a CRM or billing platform using one shared API key. As a result, the agent can do anything that key permits, and user-level authentication in Slack does nothing to restrict what the agent can do in external systems.
Alter acts as a proxy and manages downstream credentials for every API request an agent makes. It takes the identity of the end user into account for each action, automatically applying the context of the person the agent is acting for. It also enforces fine-grained runtime policies and records compliance-grade audit logs.
The founders said the idea grew from the difficulty of building agents in regulated industries. Srikar, who worked at Goldman Sachs, saw how expensive it was for developers to write custom authentication for multi-tenant agents with strict policy controls. Kevan, a second-time founder, has experience selling deep tech into highly regulated environments. The team says early users include startups building SRE and back-office agents that work with QuickBooks and Rippling, as well as a defense contractor building air-gapped agents for the Marine Corps.
Alter supports hundreds of providers, each manually tested end to end, and offers custom policies, agent delegation, user attribution, and an LLM gateway with guardrails that is coming soon. The company uses usage-based pricing, with a free tier up to 10,000 requests.
Source: Hacker News · Summarized by HeadlinesBriefing