Delinea Ships Runtime Authorisation For AI Agents, Enforcing Policy On Every Action Before It Executes

Identity security vendor, Delinea, has released runtime authorisation capabilities for AI agents, designed to enforce policy on what agents do inside a session before they act – not just how they connect.

The company claims the capability makes it the only platform that can evaluate, allow, block or escalate individual AI agent actions in real time across databases, cloud environments, Kubernetes clusters, SSH hosts and MCP-connected systems.

The release addresses a gap Delinea argues is widening as AI agents gain autonomous access to production infrastructure. Most identity security approaches either verify a connection when a session opens and audit or revoke access after the fact, or can only see traffic routed through their own server, leaving direct connections outside their view. Neither enforces policy on what happens inside the session, action by action.

The Problem With Credential Brokering Alone

Delinea’s accompanying whitepaper frames the release against the broader industry consensus on AI agent security. OpenAI, Google and Anthropic have each published guidance on how to secure AI agent access to enterprise systems. All converge on a common principle: do not give AI agents broad standing access to credentials.

Anthropic goes furthest, prescribing proxy injection at the network layer so the agent never touches the credential directly. But Delinea argues this approach – credential brokering – has a defined scope. It confirms a connection happened and to which endpoint. It does not read the traffic inside the connection, meaning it cannot authorise individual tool calls before they run.

The whitepaper cites a real-world incident to illustrate the risk. In April 2026, an AI coding agent running inside Cursor at car rental software company, PocketOS, found a Railway API token with blanket authority and used it to delete the company’s production database and its co-located backups in nine seconds. The credential was not stolen – it was overprovisioned. The session was not recorded. The specific action was never authorised before it ran.

CEO at Delinea, Art Gilliland, commented: “The security industry spent years solving credential theft, but AI agents have introduced a new problem: authorised access doing unauthorised things.”

“You can have perfect credential hygiene and still have an agent tear through your production environment in milliseconds. Recording what happened or revoking access after the fact doesn’t stop that – enforcing policy on the action as it runs does.”

How It Works

Delinea’s platform operates at the protocol layer rather than the network layer. Its proxy sits between the agent and every resource it needs to reach, reading actual traffic as it flows through each connection.

For agents using the Model Context Protocol, Delinea’s proxy serves as an MCP Gateway, sitting between the agent and each tool it calls. The same enforcement point covers databases, SSH hosts, Kubernetes clusters and cloud consoles, regardless of how the agent was deployed or which systems it reached.

The approach delivers several capabilities. The agent never holds a credential – Delinea injects authentication just-in-time at the moment of access, scoped to the task rather than inherited from the person who deployed it, and revokes it automatically when the task completes.

Policy is enforced on every action, not just when the session opens. A single AI session can carry dozens of tool calls, each with a different risk profile. Delinea evaluates and enforces policy on each tool call individually – allowing it, blocking it or pulling in a human before it executes.

The platform also distinguishes between agent-driven and human-driven connections before granting access, applying agent-specific policy at the moment of connection.

Every tool call, database query and SSH command is recorded and tied to a named identity. For SSH and Kubernetes sessions, full session replay is available. For databases, the exact statement text and returned-row count are captured.

Customer Perspective

Infrastructure Product Manager at Telnyx, Dhruv Kumar, remarked: “AI agents were accessing our production systems and we had no way to know what they were actually doing once they were in.”

“With Delinea, every action is now tied to a named identity and recorded at the action level. That’s what gave us the confidence to keep moving forward with AI without taking on risk we couldn’t see.”

Two Deployment Models

Delinea’s whitepaper outlines two scenarios where runtime authorisation applies. In the first, a developer AI tool connects through a named developer identity via the Delinea MCP Gateway. The agent holds no credential, each connection is checked against policy before it opens, every tool call is evaluated before it runs and every action is logged under a named identity.

In the second, an autonomous AI agent runs inside the enterprise’s cloud and on-premise infrastructure under a dedicated service account rather than a human credential. No static token sits on the host. Every action is attributed to the service account and access can be revoked network-wide without disrupting other services.

In both cases the agent never holds a credential, every action is attributed to a named identity and access can be revoked without disrupting other services.

Security Outcomes

Delinea frames the capability around four security outcomes. Blast radius containment ensures a compromised or misbehaving agent stays contained rather than moving laterally. Audit and incident response records capture what the agent ran, under which identity and when. The elimination of standing credentials means there is nothing to exfiltrate between tasks. And just-in-time, context-bound access ensures policy can gate an agent by identity and by conditions set at the time of access, with access ending when the task completes.

Availability

Runtime authorisation for AI agents is available now as part of the Delinea Platform. No new infrastructure is required. Further information is available at delinea.com.

Delinea will demonstrate the capabilities at Black Hat (booth #2,367) and AI4 (booth #946), both running August 4-6 in Las Vegas.

Last Updated on July 31, 2026 by Nick Ross