IDENTOS has made PolicyArc generally available, giving enterprises a central service for defining, enforcing and auditing access policies across connected applications. The Canadian company is targeting authorization for people, services and AI agents, including agents using a limited delegation of a person’s access.
IDENTOS cites IBM and the Ponemon Institute’s 2026 Cost of a Data Breach Report, which found that 92 percent of organizations that experienced an AI-related breach lacked proper AI access controls. The company says traditional access control was not built to give an agent just enough access for just long enough.
PolicyArc evaluates whether an action is permitted when a request occurs. Its decisions combine standing information, such as a person’s role and verified identity, with current context, including the sensitivity of a resource and the stage of a workflow. A policy can allow access, deny it or require additional verification.
For AI agents, users can grant a scoped, time-limited version of their own permissions. Access is automatically revoked when the task finishes or the authorized period ends.
The service also checks requests against what the data owner has agreed to. IDENTOS says this consent check happens on every access request, rather than only when a user logs in.
Teams can define a resource type once and apply its policy across connected applications. IDENTOS says new resource types and rules can be introduced without rewriting integrations. Every access decision is automatically logged and can be reported for audit and compliance review.
The intended users include platform and security engineering leads responsible for authorization across multiple products, compliance and risk teams assessing whether access was appropriate, and developers adding AI-agent features. IDENTOS, founded in 2014, says PolicyArc builds on more than 12 years of identity and access work in Canadian government and healthcare systems, that it is ISO 27001 and SOC 2 Type II certified, and that all its products use Canadian data residency.
“PolicyArc takes everything we’ve learned about access and identity and applies it to the question every enterprise is now asking: how to adopt AI without losing control,” said Mike Cook, chief executive of IDENTOS.
“Most systems only know how to grant broad, standing access. That’s fine for a person, but reckless for an agent,” said Alec Laws, IDENTOS’s chief technology officer. “We built PolicyArc so a team can hand an agent exactly the permission it needs for one task, nothing more. When the task ends, the access disappears, and every decision is on record.”
Sources: IDENTOS
–
By the ID Tech Editorial Team
