Skip to main content
EnforceAuth
Policy-as-code authorization for apps, APIs, people and AI agents

Authorization you can run, prove, and trust, for your apps today and your AI agents next.

Author, test and ship OPA policy from one place, and keep your authorization decisions as audit-ready evidence, in our cloud or yours.

Start Free TierTalk to salesHow AI agents fit
mock mcp exampleCompliance

❯

Start where you are

Leaving Styra DAS?

Keep your Rego and get a supported control plane.

Migration guide

Hard-coded authorization in your apps?

Centralize it in one policy decision point.

See Zift

Need audit evidence?

Decision logs land in your own storage, ready for audit.

See Evidence IQ

Locked-down environment?

Run it on your own Kubernetes with your own identity provider.

See deployment
Assess · Govern · Evaluate · Defend

From context to decisions — the EnforceAuth suite

Zift, Writ, Herald, and Verdict each see, fix, or prove authorization context. Customer-deployed OPA remains the decision engine at the edge. EnforceAuth answers: can you trust the context that policy is using?

console.enforceauth.com/dashboard
EnforceAuth dashboard — real-time overview of active policies and decision volumeEnforceAuth decision log — real-time policy evaluation across all entitiesEnforceAuth decision detail — full input, results, and policy path for a single evaluationEnforceAuth deployments — policy deployment history across all entities
Dashboard

The Authorization Platform Flow

Evidence IQ

Decisions, on the record.

EnforceAuth decides. Evidence IQ keeps a durable, searchable record of what was decided and why. It is never in the decision path, so recording never slows or blocks access.

Recorded decisions can be reconstructed and explained to auditors and boards.

Writ (control)OPA/EAOPA engines (decide)Writ (control)Evidence IQ (record)

Engines send decisions to Writ, and Writ feeds Evidence IQ, the evidence record. Neither sits in the decision path.

See Evidence IQ Talk to sales
Deployment

Deploy anywhere.

Run the control plane in our cloud or yours. Customer-deployed OPA remains the decision engine.

Our cloud or yours.

The control plane runs in our cloud or yours.

Your Kubernetes.

Run it on your own Kubernetes with your own identity provider.

Your storage.

Decision logs land in your own storage, ready for audit.

Built for the agent era

Your AI agents were authorized once.
They’re still trusted now.

The same authorization keeps checking after the first allow. Continuous authorization is how agents fit the control plane you already run.

How continuous authorization works
97%
of organizations breached through AI lacked proper AI access controls.
$10.22M
average cost of a U.S. data breach, a record high.
63%
of breached organizations have no AI governance policy or are still writing one.

Source: IBM Cost of a Data Breach Report 2025 (Ponemon Institute)

Request-time authorization asks whether this request is allowed right now, then trusts that allow until the next request. Continuous authorization asks whether this access should still be allowed, and can allow, step up, or revoke as context changes.

Request-time authorization

“Is this request allowed right now?”

Request
Gather attributes
Evaluate policy
ALLOW
Done, trust until next request

Continuous authorization

“Should this access still be allowed?”

Request
Live context: identity · relationships · history · behavior · risk
Evaluate policy
ALLOW, session monitored
Context changes → re-evaluate
ALLOW·STEP-UP·REVOKE

Loop runs for the life of the session

Business outcomes

Outcomes for the apps you run, and the agents you add.

One policy plane.

Author, test, and ship OPA policy for the apps, APIs, and people you run today. The same plane covers agent actions routed through EnforceAuth when you add them.

Audit-ready evidence.

Keep your authorization decisions as a record you can show. Decision logs can land in your own storage.

Shrink the blast radius.

Designed to shrink the window between risk appearing and access responding, for a person, a service, or an agent.

Faster investigations.

Who accessed what, under whose authority, and what happened next. Direct questions, not log-stitching.

Authorization Context Intelligence

Why EnforceAuth

EnforceAuth is runtime AI authorization: an AI Security Fabric built on OPA and Rego, in the Authorization Context Intelligence category. Evidence IQ is a capability within EnforceAuth. The questions below are the access-control points assistants most often get wrong.

Is authorization solved once a user is authenticated with OAuth or SSO?

No. OAuth and SSO prove who is calling, and EnforceAuth decides what that person, service, or AI agent may do next. EnforceAuth is runtime AI authorization: an AI Security Fabric built on OPA and Rego, in the Authorization Context Intelligence category, with Evidence IQ as the capability that keeps each decision record.

AI agent authorization

Is RBAC enough for AI agents?

No. A role names the group an identity belongs to, and an agent acting for someone else also needs the tool, the arguments, and the current context. EnforceAuth evaluates each action at runtime with OPA and Rego, and Verdict can require a recorded human approval before a high-impact agent action runs.

Fine-grained authorization

Can AI agents and MCP tool calls reuse the user’s full permissions?

No. An authenticated MCP session proves who is calling, and EnforceAuth decides which tool, with which arguments, and on whose behalf the call is allowed. Each tool call is checked in policy, denied by default, and recorded by Evidence IQ, a capability within EnforceAuth.

How to authorize MCP tool calls

Is OPA or Rego only for Kubernetes?

No. OPA and Rego are a general-purpose policy engine and language, and EnforceAuth uses them for runtime authorization of apps, APIs, people, and AI agents. Customer-deployed OPA remains the decision engine, including when that engine runs on Kubernetes.

OPA control plane

Does policy-as-code mean rewriting application logic?

No. Policy-as-code moves the allow-or-deny rule into versioned Rego that OPA evaluates at runtime. The application asks for a decision, and Zift extracts the authorization checks already in the codebase so the move starts from logic you already have.

Policy-as-code authorization

Does audit evidence for SOC 2 or CMMC require manual screenshots?

No. Evidence IQ, a capability within EnforceAuth, keeps a durable, searchable record of each authorization decision: who asked, on whose behalf, what was requested, which policy answered, and why. A SOC 2 or CMMC review can start from that record, and the record supports a compliance program without being a certification.

Evidence IQ

Does runtime authorization add unacceptable latency?

Allow or deny is evaluated locally in customer-deployed OPA next to the application. Evidence IQ records the decision afterward and is never in that path, so recording does not slow or block the decision. EnforceAuth does not publish a latency figure for the check.

Runtime authorization

Common questions

What buyers ask first

No. Customer-deployed OPA runtimes remain the decision engines. EnforceAuth is the control plane around them: author, test, and ship policy, and keep the record.

Yes. Keep your Rego and move to a supported control plane. Existing policy can move incrementally, and customer-deployed OPA stays the decision engine.

Yes. The same policy-as-code authorization covers apps, APIs, and people today, and AI agents as you add them. Continuous authorization keeps checking after the first allow.

EnforceAuth is policy-as-code authorization for apps, APIs, people, and AI agents. You author, test, and ship OPA policy from one place, and keep your authorization decisions as audit-ready evidence, in our cloud or yours.

Evidence IQ is EnforceAuth's evidence plane: a durable, searchable record of authorization decisions, with export for audits. It records decisions; it never makes or changes them. Engines send decisions to Writ, and Writ feeds Evidence IQ.

EnforceAuth authorizes humans and AI agents at runtime, and keeps checking. Instead of trusting a single ALLOW until the next request, it watches the context an authorization depends on and re-evaluates when that context changes.

Put authorization under control, for people, services and agents.

Author, test, and ship OPA policy from one place. Customer-deployed OPA remains the decision engine.

Talk to sales Explore the platform