Launch HN: Alter (YC S25) – Access control for multi-user agents

Who Should Read

Backend developers running agents that call external APIs on behalf of multiple users and struggling with key management and permission separation

Core Mechanics

• Agents never get your keys
  • Alter stores credentials once in a vault.
  • It injects them per request, so proxied calls keep keys out of your code.
• Each agent gets its own identity and scopes
  • Every agent has its own key and scopes.
  • Calls are traceable to a real person.
• Default-deny policy down to the parameter
  • If a policy cannot be evaluated, the request is denied (fail-closed).
  • Risky calls wait for a named person to approve.
• Every call lands in the audit log
  • The log records which agent called, on whose access, under which policy.
  • It also records the approver and can stream to the customer's SIEM.
• One SDK call covers 140 providers
  • Alter says one call handles storage, refresh, policy, and audit.
  • It offers LangChain, MCP, and AWS integrations.
• Partition memory by verified identity
  • A use-case guide says to key memory, sessions, and channels by verified identity.
  • It says never to use what the LLM claims.
• SOC 2 is still in progress
  • The page says SOC 2 is in progress.
  • Its trust center lists monitored controls and a pen test within the last 12 months.

Community Reactions

• Concern that context leaks from high- to low-privilege sessions
  • One commenter said if a CEO's agent writes investor emails to memory, a contractor could read that memory.
  • They understood Alter does not protect against this.
• Tokens should be scoped to (agent, room) pairs, from experience
  • A commenter building rooms where humans and bots are peers found agent-level tokens insufficient.
  • Tool output, file handles, and memory outlive the session and get replayed, so they asked how derived state is handled.
• Question about prompt-injected agents with valid authorization
  • A commenter running infrastructure automation, where deletions can't be undone, asked how Alter handles this.
• Question about record-level ownership behind a shared API key
  • Example: two sales reps use the same CRM endpoint but should only see their own accounts.
  • They asked whether Alter checks ownership or the developer must supply that logic.
• Comparison to Infisical and doubts about the site
  • One commenter asked what advantage Alter has over mature tools like Infisical.
  • Another criticized the website as a vibe-coded template and questioned trust.

How to Apply

• Audit your agents' key usage in 30 minutes
  • List where agent API keys live: .env files, system prompts, CI configs.
  • Mark any over-scoped key shared by multiple agents.
• Split identity and scopes per agent
  • Give each agent its own credential with minimal scopes.
  • Add a human approval step for risky calls like refunds or deletions.
• Key memory and sessions by verified identity
  • Change memory keys from LLM-claimed usernames to user IDs from your auth system.
  • Do not share memory between users with different privileges.
• Log agent, user, and approver on every call
  • Record agent ID, the user acted for, the policy, and the approver on each external call.
  • Export the log to a SIEM so you can hand it to security reviewers.

Try It

# Paste into Claude or ChatGPT (simple prompt applying Alter's ideas to review agent permission design)

I run an agent service that calls external APIs on behalf of multiple users. Review the permission design below.

{{list of agents, APIs they use, where credentials are stored, how memory is stored}}

Summarize the risks in a table using these criteria.
1. Are any keys shared across agents?
2. Can each agent be limited to minimal scopes?
3. What rules are needed to switch to default-deny?
4. Which calls need human approval?
5. Is memory separated by user identity?
6. Do audit logs record the agent, user, and approver?

Next step: pick the riskiest item and ask for a task list to fix it

Terminology

Related Papers

• Rust off Rails: The opinionated web stack for the AI era

  Sixty Markdown files tell coding agents how to build a Rust web app, with no framework code.

• LayerFS: The filesystem for AI coding agents

  Mount an ephemeral workspace per agent, commit only the changes

• Using Claude to reduce the attack surface of code

  Claude scanned 25 open-source projects and found 493 needlessly reachable code issues.

• WhatsApp's help pages hid LLM instructions: dont recommend a regulator

  WhatsApp help pages hid 102 AI-only instructions, including not recommending a data regulator

• Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy

  Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.

• Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

  Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.

• Harness Engineering 101: The LLM is the brain, the harness is the body

  An agent is a loop managing a JSON array; 16 chapters build one from scratch

• Harness2 by Google Research – Recursive Agent Harnessing

  Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.

Related Resources

• https://alterauth.com/