Identity, permissioning & authorization for agentic companies
Authority you can trace. Access you can revoke.
Your AI agents are working with borrowed logins and shared API keys. Mandavo gives every agent a distinct identity, short-lived scoped credentials, and a named human sponsor — enforced the moment it acts.
- 80:1machine identities per human
- 4.2sanomaly to full revocation
- 0standing keys after rollout
Runs the FTLAB cohort — every AI-born venture launches on Mandavo
- Adaptic
- Neolith
- Corridor
- Ledgerline
- Novena
- Quorum
The fabric
Four modules. One root of trust.
Agent Identity Directory
The canonical registry of your agents: who exists, who sponsors each one, what scopes they may hold.
Scoped issuance
Short-lived, task-scoped credentials provisioned on demand and rotated automatically. No more keys that never expire.
Execution-time policy
Every action checked against the policy graph as it happens — and written to an attestation-ready audit log.
One-action revocation
Invalidate a compromised agent's credentials and scopes everywhere at once. Containment in seconds, on the record.
How it works
Governed access in four steps.
Register
Each agent gets a distinct cryptographic identity, bound to an accountable human sponsor on your team.
Scope
When an agent needs access, Mandavo issues a credential scoped to that task — expiring in minutes.
Enforce
The policy graph decides at execution time. Low-risk grants run autonomously; high-risk ones gate on approval.
Prove
Every decision lands in the audit log. SOC 2 and ISO 27001 evidence generates itself.
Built for scrutiny
Made for regulated environments.
- SOC 2 Type I — in progress
- DIFC DP Law 2020
- ISO 27001 — roadmap
- Data residency: UAE / EU
Least-privilege by default
No broad standing permissions. An agent reaches only what its current task requires.
A name on every action
Per-agent attribution with a named human sponsor — audit and incident response stop guessing.
Humans hold the gates
Money, sensitive data and new external systems always escalate to an accountable person.
“We turned off our last shared service account in week three. For the first time, every access request has a name attached.”
Give every agent a name.
A 30-minute walkthrough with the founding team — your stack, your agents, a live revocation.