Let your agents run. (safely)
Opal Zero inventories every agent, maps to an owner, decides every request it makes, and enforces that decision in the MCP gateway you already run.
0
1
The problem
You want your agents to run. But you need to give them the appropriate access.
0
2
Unlike humans, agents lack inhibition.
Humans
Deliberate about what they request and what they use.
Agents
Inherit broad access, use it, and multiply faster than human judgment can scale.
agent and NHI growth
more entitled than a person
never reviewed
0
3
It's a million-to-one decision problem.
Not a hundred-to-one identities problem.
The CISO's mandate
Written policy
Request context
Approved in 90s
invoices.write only
Expires in 4h
Reasoning recorded
Can you approve this, the invoice run is blocked...
Absolutely, feel free to proceed!
The whole decision
Approved in 30s
Full Stripe admin
No expiry
No record
0
4
What the industry is saying
“Opal Zero gets that agentic accountability isn’t a compliance checkbox, it’s an architecture problem, and they are building the plumbing for it.”
Mrityunjay Gautam · CISO, Instacart
instacart
See every agent
Okta
Entra
Anthropic
OpenAI
Bedrock AgentCore
CURSOR
One inventory of every agent across the identity providers and AI platforms you already run.
![](data:image/svg+xml,<svg display="block" id="2504873097" role="presentation" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><g fill="transparent" height="16px" id="i897lQEX4" width="16px"><path d="M 0 0 L 16 0 L 16 16 L 0 16 Z" fill="transparent" height="16px" id="VUIL3LmDq" width="16px"/><path d="M 3.907 0 L 9.427 0 L 13.333 3.907 L 13.333 9.427 L 9.427 13.334 L 3.907 13.334 L 0 9.427 L 0 3.907 Z M 6.664 4 L 6.664 6.667 M 6.664 9.334 L 6.671 9.334" fill="transparent" height="13.334px" id="v3WeM4e5E" stroke-dasharray="" stroke-linecap="square" stroke-linejoin="round" stroke-width="1.333" stroke="rgb(0, 0, 0)" transform="translate(1.336 1.333)" width="13.333px"/></g></svg>)
Surface the risk
Off-purpose
Unowned
Standing access
Inline fix
What's off-purpose, unowned, or standing, explained by the product and routed to the owner with the fix inline.
![](data:image/svg+xml,<svg display="block" id="4279797925" role="presentation" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><g fill="transparent" height="16px" id="zuqPC60hP" width="16px"><path d="M 0 0 L 16 0 L 16 16 L 0 16 Z" fill="transparent" height="16px" id="GFhgQrIvy" width="16px"/><path d="M 2 4 C 3.105 4 4 3.105 4 2 C 4 0.895 3.105 0 2 0 C 0.895 0 0 0.895 0 2 C 0 3.105 0.895 4 2 4 Z" fill="transparent" height="4px" id="Kp8vhpYqT" stroke-dasharray="" stroke-linecap="round" stroke-linejoin="miter" stroke-miterlimit="10" stroke-width="1.333" stroke="rgb(0, 0, 0)" transform="translate(6 6)" width="4px"/><path d="M 12.267 9.334 C 12.085 9.745 12.172 10.225 12.487 10.547 L 12.527 10.587 C 12.843 10.901 12.981 11.353 12.894 11.791 C 12.808 12.229 12.507 12.594 12.095 12.764 C 11.596 12.97 11.022 12.855 10.64 12.474 L 10.601 12.434 C 10.279 12.119 9.799 12.032 9.387 12.213 C 8.984 12.386 8.722 12.782 8.72 13.221 L 8.72 13.334 C 8.72 14.07 8.123 14.667 7.387 14.667 C 6.651 14.667 6.054 14.07 6.053 13.334 L 6.053 13.273 C 6.043 12.822 5.758 12.422 5.333 12.267 C 4.922 12.085 4.442 12.172 4.12 12.486 L 4.08 12.526 C 3.631 12.98 2.924 13.051 2.393 12.696 C 1.863 12.342 1.658 11.661 1.904 11.072 C 1.971 10.911 2.069 10.764 2.194 10.64 L 2.234 10.601 C 2.549 10.279 2.636 9.798 2.454 9.386 C 2.282 8.984 1.886 8.722 1.447 8.72 L 1.333 8.72 C 0.597 8.72 0 8.123 0 7.387 C 0 6.651 0.597 6.054 1.333 6.053 L 1.393 6.053 C 1.845 6.043 2.245 5.758 2.401 5.333 C 2.582 4.922 2.495 4.442 2.181 4.12 L 2.141 4.08 C 1.619 3.559 1.619 2.715 2.14 2.193 C 2.662 1.672 3.506 1.672 4.027 2.193 L 4.067 2.233 C 4.389 2.548 4.869 2.635 5.28 2.454 L 5.333 2.454 C 5.737 2.281 5.999 1.885 6 1.447 L 6 1.333 C 6 0.597 6.598 0 7.334 0 C 8.07 0 8.668 0.597 8.668 1.333 L 8.668 1.393 C 8.669 1.832 8.931 2.228 9.334 2.401 C 9.745 2.582 10.226 2.495 10.548 2.18 L 10.588 2.14 C 10.922 1.79 11.419 1.648 11.888 1.769 C 12.357 1.891 12.723 2.257 12.845 2.726 C 12.966 3.195 12.824 3.692 12.473 4.026 L 12.434 4.066 C 12.119 4.388 12.032 4.869 12.213 5.28 L 12.213 5.333 C 12.386 5.737 12.782 5.999 13.22 6 L 13.333 6 C 14.07 6 14.666 6.597 14.666 7.333 C 14.666 8.07 14.07 8.666 13.333 8.666 L 13.273 8.666 C 12.835 8.669 12.44 8.931 12.267 9.334 L 12.267 9.334 Z" fill="transparent" height="14.666999999999998px" id="TQHyB1oUQ" stroke-dasharray="" stroke-linecap="round" stroke-linejoin="miter" stroke-miterlimit="10" stroke-width="1.333" stroke="rgb(0, 0, 0)" transform="translate(0.663 0.667)" width="14.6665px"/></g></svg>)
Fix the cause
Policy change
waiting time
unused access
One policy change beats a thousand one-off remediations. Prices waiting time and unused access in hours and dollars.
Decide every request
Least-privileged path
Owner boundary
Shown reasoning
Reads each request the way your best security engineer would, and shows its reasoning.
Enforce the decision
Unity Gateway
AgentCore Gateway
Scoped
Time-bound
Writes the decision as scoped, time-bound policy into the MCP gateway you already run. No rip and replace, no second control plane.
0
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><path d="M 5.333 13.333 C 5.333 13.333 10.667 10.667 10.667 6.667 L 10.667 2 L 5.333 0 L 0 2 L 0 6.667 C 0 10.667 5.333 13.333 5.333 13.333 Z" fill="transparent" height="13.333319999999999px" id="equA7u1gL" stroke-dasharray="" stroke-linecap="square" stroke-linejoin="round" stroke-width="1.33333" stroke="rgb(255, 255, 255)" transform="translate(2.666 1.334)" width="10.666680000000001px"/></svg>)
standing permissions
![](data:image/svg+xml,<svg display="block" id="3761401431" role="presentation" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><g fill="transparent" height="10.665999999999997px" id="muGNhLACw" transform="translate(1.336 2.667)" width="13.333999999999946px"><path d="M 13.334 0 L 9.334 0 L 8 2 L 5.333 2 L 4 0 L 0 0" fill="transparent" height="2px" id="hL4LKGMoJ" stroke-dasharray="" stroke-linecap="butt" stroke-linejoin="miter" stroke-miterlimit="10" stroke-width="1.333" stroke="rgb(255, 255, 255)" transform="translate(0 5.333)" width="13.333999999999946px"/><path d="M 2.3 0.739 L 0 5.333 L 0 9.333 C 0 10.069 0.597 10.666 1.333 10.666 L 12 10.666 C 12.736 10.666 13.333 10.069 13.333 9.333 L 13.333 5.333 L 11.033 0.74 C 10.808 0.287 10.346 0.001 9.84 0 L 3.493 0 C 2.987 0 2.525 0.287 2.3 0.74 Z" fill="transparent" height="10.665999999999997px" id="rVcxumNIG" stroke-dasharray="" stroke-linecap="butt" stroke-linejoin="miter" stroke-miterlimit="10" stroke-width="1.333" stroke="rgb(255, 255, 255)" width="13.33299999999997px"/></g></svg>)
human toil
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><g d="M 0 16 L 0 0 L 16 0 L 16 16 Z M 14.667 7.387 L 14.667 8.001 C 14.666 9.438 14.201 10.837 13.34 11.988 C 12.479 13.14 11.269 13.982 9.891 14.39 C 8.512 14.797 7.039 14.748 5.69 14.25 C 4.342 13.752 3.19 12.831 2.408 11.625 C 1.625 10.419 1.254 8.993 1.348 7.558 C 1.443 6.124 1.999 4.758 2.933 3.665 C 3.867 2.572 5.129 1.811 6.531 1.494 C 7.934 1.177 9.401 1.322 10.714 1.907 M 14.667 2.666 L 8 9.339 L 6 7.339" fill="transparent" height="16px" id="D3cCFWK3k" width="16px"><path d="M 0 16 L 0 0 L 16 0 L 16 16 Z" fill="transparent" height="16px" id="qhByo01LO" width="16px"/><path d="M 13.333 6.057 L 13.333 6.67 C 13.333 8.108 12.867 9.507 12.006 10.658 C 11.145 11.81 9.936 12.652 8.557 13.06 C 7.178 13.467 5.705 13.418 4.356 12.92 C 3.008 12.422 1.856 11.501 1.074 10.295 C 0.292 9.089 -0.08 7.663 0.014 6.228 C 0.109 4.794 0.665 3.428 1.599 2.335 C 2.533 1.242 3.795 0.481 5.197 0.164 C 6.6 -0.153 8.067 -0.008 9.38 0.577" fill="transparent" height="13.33331820665041px" id="Gs80lcw7T" stroke-dasharray="" stroke-linecap="square" stroke-linejoin="miter" stroke-miterlimit="10" stroke-width="1.33333" stroke="rgb(255, 255, 255)" transform="translate(1.334 1.33)" width="13.333311084581034px"/><path d="M 8.667 0 L 2 6.673 L 0 4.673" fill="transparent" height="6.67333px" id="idsX0jB3e" stroke-dasharray="" stroke-linecap="square" stroke-linejoin="miter" stroke-miterlimit="10" stroke-width="1.33333" stroke="rgb(255, 255, 255)" transform="translate(6 2.666)" width="8.6667px"/></g></svg>)
friction
0
6
Launch offer, through 30 Dec
Three Zero for the first year.
Every agent inventoried, every request decided, every decision enforced. No agent cap, no procurement cycle before you can see it working.
THE TERMS
Agent control is uncapped
Full Opal Zero platform. Inventory, Risk Center, Policy Insights, Paladin and Gateway Enforcement.
Per human identity, billed annually
Opal Zero is priced based on your headcount, not on agent count. Agent growth doesn't cost you more decisions.
Good through this year
$30k for a one year term, offer available until December 30th. Organizations must be under 3,000 employees to qualify, organizations above 3,000 please inquire for the enterprise package.
0
Pricing promo
From our design partners
“Agent adoption moves faster than governance usually does. Opal Zero helps close that gap.”
Mallory Rudolph · IT IAM Engineer, Faire
"Unity Gateway gives us a single place to see and control what every one of them is touching. Opal Zero helps sharpen how we express that access in policy."
Jack Zaldivar Jr. · Staff Systems Engineer, Databricks
“Opal Zero moves beyond inventory to real-time, policy-driven access decisions.”
Den Potapenko · Head of Corporate IT and Security, Superhuman
“We’re interested in how Opal Zero could support access governance for AI agents: clear owners, standard access reviews, and just-in-time access.”
Jean-Sebastien Caron · Sr. Manager, InfoSec Security Architecture, Elastic
Partnerships and integrations
Opal Zero launches with the platforms your agents already run on.
INFERENCE AND INVENTORY
The Anthropic connector brings every Claude deployment, API key, and managed agent into the access graph.
ENFORCEMENT
Access decisions are written into Unity Gateway as scoped, time-bound policy. No second control plane.
CROSS APP ACCESS
Agent-to-app connections are governed on the same terms as people, with Opal deciding what each connection is allowed to do.