SoulAuth
Agent Identity &
Zero-Trust Authorization
Every AI agent deserves an identity. Every action deserves authorization.
SoulAuth gives your AI agents durable cryptographic identities and evaluates every action against real-time policy. No standing permissions. No over-provisioned access. No blind trust.
Everything you need to secure
your agent fleet
Ten deeply integrated capabilities, from identity to incident response. Built for production. Built for scale.
SoulKey Identity
Durable cryptographic agent identities that persist across sessions. Not disposable tokens - real identity anchors for your agent fleet.
Zero-Trust PDP
Just-in-time policy evaluation for every request. No standing permissions, no cached authorizations. Every action is evaluated fresh against current policy.
Capability Tokens
Short-lived tokens scoped to specific actions and resources, with introspection on every request. Tokens expire before they can be abused.
Policy-as-Code
Deny-by-default authorization rules defined as code. Version-controlled, auditable, reviewable - with a monitor-first mode so you can watch before you enforce.
Multi-Tenant RBAC
Full tenant isolation under a Platform → MSSP → Tenant → Agent role hierarchy. Each tenant gets its own policy namespace, audit stream, and identity pool.
Audit Trail
Append-only, SoulKey-signed event log (hybrid Ed25519 + post-quantum ML-DSA). Every decision, evaluation, and identity operation - recorded and tamper-evident.
OIDC Single Sign-On
Bring your identity provider. Operators sign in through generic OIDC SSO, with claims mapped onto the RBAC hierarchy - fail-closed by design.
SoulWatch Signals
Identity activity feeds SoulWatch behavioral detection. Anomalies on an agent identity can trigger review or automated quarantine.
Quarantine Engine
Automated response when threats are detected. Isolate compromised agents, revoke tokens, and contain incidents - policy-driven and audit-logged.
Usage Metering
Per-agent, per-tenant usage metering with a cost / budget governor. Runaway agents hit the budget wall before they hit your invoice.
How SoulAuth works
Every request follows a zero-trust path from agent to resource.
Simple to integrate
A few lines of Python. That's all it takes.
# Point your agent's MCP / memory client at the
# Tiresias proxy instead of the backend directly.
{
"mcpServers": {
"memory": {
"url": "https://tiresias.your-infra.internal/mcp",
"headers": { "Authorization": "Bearer <capability-token>" }
}
}
}
# Identity, policy, and audit happen in the proxy -
# your agent code doesn't change.# policy-as-code: deny-by-default, version-controlled
policies:
- name: analytics-read
effect: allow # everything not allowed is denied
agents: ["analytics-*"]
actions: ["memory.read"]
resources: ["customer-data", "reports"]
mode: monitor # observe first, enforce when readyWorks with your stack
Deploy however you want. Integrate with what you already use.
MCP-Native
drop-in for MCP backends
REST API
JSON, token-authenticated
Docker
container-first deploy
Self-Hosted
runs in your infra
Secure your agents today
SoulAuth is in private beta. Request a design-partner slot for early access to the full platform. Your agents are one SoulKey away from zero-trust security.