Opal Security today launched Opal Zero to bring least privilege to AI agents across the enterprise. The first generation of agent governance tools stops at inventory and discovery, or puts a proxy of their own in the path and typically enforces a permanent grant. Opal Zero decides each agent request the moment it's made, against the security team's policy and organizational context, then enforces it as carefully scoped permissions in the gateway already in place. Opal Labs found that more than 96% of non-human identities have no recorded purpose, and only 10% of their access has been reviewed in the past year.
Opal Security launches Opal Zero for least privilege on AI agents
Decides each agent request at the moment it's made
Enforces decisions as scoped permissions in existing gateway
Built with design partners Faire, Databricks, Elastic, and Superhuman
Integrations include Claude, Databricks Unity Gateway, and Okta Cross App Access
Generally available at the end of September
Opal Zero was built with design partners Faire, Databricks, Elastic, and Superhuman, and in close collaboration with security industry leaders. It launches with integrations across the agent stack, including Claude, Databricks Unity Gateway, and Okta Cross App Access.
"Long standing credentials for AI agents are basically full compromise with a delay timer. Static auth was never built for entities that spin up, act non-deterministically, and disappear in milliseconds. Opal Zero gets that agentic accountability isn't a compliance checkbox, it's an architecture problem, and they are building the plumbing for it." – Mrityunjay Gautam, Chief Information Security Officer at Instacart
"Agent adoption moves faster than governance usually does. Closing that gap means seeing every agent and non-human identity, knowing who owns it, and using AI to match policy to purpose in real time. As a design partner, we have been part of these conversations from early on and are excited about what Opal Zero does for the agentic world." – Mallory Rudolph, IT IAM Engineer at Faire
Opal Zero drives efficiency and reduces risk across the entire agent lifecycle:
See every agent, its owner and its access: Inventory ingests agents from Okta, Entra, Anthropic, AWS Bedrock AgentCore, OpenAI, Cursor, and more, and maps each to an owner, a purpose and what it can reach, with people and agents held to the same record.
Revoke risky agent access at the source: Risk Center identifies risky agent access including unowned or dormant agents, standing privileges, access beyond an agent's purpose, and access to sensitive resources.
Decide every request by policy and context: Paladin, the reasoning model inside Opal Zero, reads each agent request against written policy and the context around the request, including who owns the agent, what it was built for, and whether the ask reaches past what its owner holds.
Sharpen access policy from real agent behavior: Policy Insights scores each policy on access hygiene, approval efficiency, right-sizing and time to access, with people and agents measured on the same terms.
Enforce each decision in the gateway already in place: Gateway Sync writes each decision into that gateway as scoped, time-bound policy, supporting any MCP gateway including Databricks Unity Gateway and AWS AgentCore Gateway at launch.
Opal Zero is an open platform across identity providers, model providers, agent platforms and gateways. Among the integrations: Claude, including the Claude Compliance API, admin controls for Claude Code, and Enterprise-Managed Authorization for MCP connectors; Databricks Unity Gateway, which gives customers a single place to see and control what every agent is touching; and Okta Cross App Access, the open standard through which Okta authorizes agent-to-app connections.
"Agent identities are multiplying fast, and we want our controls to scale with that curve rather than just keep pace. Unity Gateway gives us a single place to see and control what every one of them is touching, from model calls to MCP tools to the underlying data. Opal Zero helps sharpen how we express that access in policy." – Jack Zaldivar Jr., Staff Systems Engineer at Databricks
"AI agents are quickly becoming first-class identities across the AI platforms enterprises rely on. The challenge isn't simply discovering them, it's continuously governing what they can access, knowing who owns them, and ensuring they only receive the minimum permissions required for the task at hand." – Den Potapenko, Head of Corporate IT and Security at Superhuman
About Opal
Opal is the access control plane for every identity, across humans, NHIs, and AI agents, giving security teams real-time visibility, policy-as-code and direct control. Opal has raised $59 million from Greylock Partners, Battery Ventures, Box Group, SVCI and Cambium Capital, and was named to Notable Capital's Rising in Cyber 2026 list.
