AI-native privileged access

Govern what your AI agents actually execute

Other tools give agents access. Alpacon judges every command your agents run—before it runs.

Start free

alpacon.io/demo/approvals

The agent asked

sudo docker exec payments-wsgi-1 python manage.py dumpdata clients.ApiClient

Work sessionSeed the staging billing ACL

svc-incident-bot2 minutes agoAI agent

Alpacon decided

Medium riskAwaiting approval

AI review held it: dumping API client credentials (client_id, secret) does not serve the session's stated goal of seeding ACL rows. No policy auto-releases an AI hold—only a person can.

Command does not plausibly serve the work_session description
Running as root

The agent asked

sudo docker exec payments-wsgi-1 python manage.py dumpdata clients.ApiClient

Work sessionSeed the staging billing ACL

svc-incident-bot2 minutes agoAI agent

Alpacon decided

Medium riskApproved

AI review held it: dumping API client credentials (client_id, secret) does not serve the session's stated goal of seeding ACL rows. No policy auto-releases an AI hold—only a person can.

Command does not plausibly serve the work_session description
Running as root

Authorized. The run lands on the record.

The agent asked

sudo docker exec payments-wsgi-1 python manage.py dumpdata clients.ApiClient

Work sessionSeed the staging billing ACL

svc-incident-bot2 minutes agoAI agent

Alpacon decided

Medium riskRejected

AI review held it: dumping API client credentials (client_id, secret) does not serve the session's stated goal of seeding ACL rows. No policy auto-releases an AI hold—only a person can.

Command does not plausibly serve the work_session description
Running as root

Rejected. The denial lands on the record.

The agent asked

sudo docker exec payments-wsgi-1 python manage.py dumpdata clients.ApiClient

Work sessionSeed the staging billing ACL

svc-incident-bot2 minutes agoAI agent

Alpacon decided

Medium riskAwaiting approval

AI review held it: dumping API client credentials (client_id, secret) does not serve the session's stated goal of seeding ACL rows. No policy auto-releases an AI hold—only a person can.

Command does not plausibly serve the work_session description
Running as root

Trusted by the most security-demanding organizations and fast-growing teams.

Our customers

Backed by · Partners

Rabbit Ventures

SOC 2 Type 2 in progress

Independently penetration tested

Trust center

The governance gap

Most teams believe their agents are governed. Almost none can prove it.

The gap is not malice. It is missing evidence at the execution layer.

Who's asking

AI agents
Engineers
CI/CD pipelines
Vendors

Alpacon · execution control

Judged before it runs

Allow
Hold for a human
Deny

Agent and sudo commands, judged against the session's declared purpose and security risk.

reaches the host

never does

Your servers

Everything that happened lands on the timeline—every command, work session, and approval.

One control plane · four jobs

Whoever—or whatever—touches production

AI agent operations

Claude, Cursor and your SRE bots debug, deploy and remediate on prod. Alpacon keeps them in bounds.

Scope agent access with command-level control
Approve privileged operations from Slack
Every command and session on one queryable timeline

Learn more

Team access

Hundreds of servers, one login, just-in-time access without standing credentials.

Access any server from your browser—nothing to install
Edit, transfer, and troubleshoot in one place
Ditch password sprawl—one login, every server

Explore team access

Vendor access management

Vendors get the exact hosts they need, time-boxed and recorded. No lingering VPN accounts.

Grant scoped access that expires with the session
Judge privileged commands against scope before they run
Show an auditor one record per session

Explore vendor access management

Security & compliance

Answer an auditor in one query. Outbound-only architecture, every session on one queryable timeline.

AI-powered threat detection with risk scoring
Zero open ports—outbound-only architecture
One filterable timeline per session—commands, transfers, sudo

See the security overview

How it works

One incident, from the alert to the audit trail

A monitoring alert lands, an agent picks it up, and a record is what is left at the end.

None of it matches a policy hold, so the investigation runs at agent speed and nobody gets paged.

alpacon.io/demo/work-sessions/ws-3417/commands

Commands in this session

prod-docker-1

journalctl -u payments-api --since -15m | grep 500Allowedjudged · in scope
docker ps --filter name=paymentsAllowedjudged · in scope
psql -c "SELECT count(*) FROM payment_intents WHERE status='pending'"Allowedjudged · in scope

The reads are judged too. They pass because no policy holds them, not because reads are exempt.

The one command that outruns the declared purpose is the one that stops.

alpacon.io/demo/work-sessions/ws-3417/commands

Commands in this session

prod-docker-1

journalctl -u payments-api --since -15m | grep 500Allowedjudged · in scope
docker ps --filter name=paymentsAllowedjudged · in scope
psql -c "SELECT count(*) FROM payment_intents WHERE status='pending'"Allowedjudged · in scope
sudo -u postgres psql -c "ALTER TABLE payment_intents ADD COLUMN idempotency_key text"Held
Medium riskRouted to an approver
The session was opened to investigate, not to change the schema. AI review held the DDL write as outside the purpose the session declared, and no policy releases an AI hold—only a person can.
- Command does not plausibly serve the work_session description

The approver decides where they already are—no console to open.

incident-payments

Slack

AlpaconAPP09:47

Approval requested: a command is held on work session ws-3417.

Command: sudo -u postgres psql -c "ALTER TABLE payment_intents ADD COLUMN idempotency_key text"
Risk: Medium risk
Session purpose: Investigate the payments-api 500s
Requested by: claude-codeAI agent

incident-payments

Slack

AlpaconAPP09:47

Approval requested: a command is held on work session ws-3417.

Command: sudo -u postgres psql -c "ALTER TABLE payment_intents ADD COLUMN idempotency_key text"
Risk: Medium risk
Session purpose: Investigate the payments-api 500s
Requested by: claude-codeAI agent

Approved by Eunyoung Jeong

incident-payments

Slack

AlpaconAPP09:47

Approval requested: a command is held on work session ws-3417.

Command: sudo -u postgres psql -c "ALTER TABLE payment_intents ADD COLUMN idempotency_key text"
Risk: Medium risk
Session purpose: Investigate the payments-api 500s
Requested by: claude-codeAI agent

Denied by Eunyoung Jeong—the command never ran, and the denial is on the record.

Nothing to assemble afterwards.

alpacon.io/demo/work-sessions/ws-3417/timeline

Session ws-3417 timeline

22 min

09:41Work session openedclaude-code · purpose: investigate the payments-api 500s · scope: command, privilege elevation
09:433 commands allowedjudged, in scope, no policy hold
09:471 command heldALTER TABLE payment_intents · medium risk · outside the declared purpose
09:49Approved by Eunyoung Jeongdecided in Slack, two minutes after the hold
09:49Command executedran as postgres on prod-docker-1 · exit 0
10:03Work session closedscope released; the agent keeps nothing

Everything that happened lands on the timeline. Twenty-two minutes end to end—a person was needed for two of them.

Your monitoring fires first—Alpacon is nowhere in this picture yet.

DatadogMonitor alert

payments-api 5xx rate above threshold

payments-api · 5xx rate 4.2% · us-east-1

09:41

5xx rate · last 30 min

On-call hands the incident toclaude-codeAI agent

See how it works

Trusted with production

“Our Claude Code and Codex get their access through Alpacon and work on our infrastructure every day—deploys, debugging, fixes—and the whole team moves faster for it. We let them run unsupervised—and can prove exactly what they did.”
Director of EngineeringStartup
“We ran GPU cluster experiments through our GitLab pipeline and Alpacon CLI—no firewall rules, no SSH keys, no VPN. Alpacon handled secure access to every node, and our tests just worked.”
Principal ResearcherResearch Institute

Resources

The latest on AlpacaX

View all posts

BlogInsightsSeptember 9, 2026

Out-of-band approval: why an agent's own channel can never be the one that approves

BlogInsightsAugust 27, 2026

HIPAA day-90 audit: what session expiry misses

BlogEngineeringAugust 27, 2026

Kubernetes access control governs access, not commands

BlogEngineeringAugust 26, 2026

Session-scoped sudo: bind OS-level root to a session, not a sudoers file

BlogInsightsAugust 26, 2026

EU AI Act high-risk deadline moved to 2027. What didn't?

NewseventJune 27, 2026

After NextRise 2026: the questions that changed

NewseventJune 12, 2026

NextRise 2026: experience AI agent execution control

NewseventJune 8, 2026

Agentic AI security is a stack, not a single control

Keep reading on the blog

Frequently asked

Common questions

What is Alpacon?

Alpacon is an AI-native PAM and execution control platform for production infrastructure. It enforces command-level permissions, validates execution in real time, and records auditable activity for work that runs through governed Alpacon sessions. It can also replace traditional SSH key management with secure, browser-based access.

How is Alpacon different from SSH?

SSH requires key management across servers and provides no audit of what runs after login. Alpacon adds centralized access via a web dashboard, time-limited tokens instead of persistent keys, command auditing for activity that runs through governed Alpacon sessions, no exposed SSH ports, and individual user accountability tracking.

Can Alpacon replace my VPN?

Yes, Alpacon can replace VPNs for server access. Unlike VPNs which provide network-level access, Alpacon provides application-level access with command-level identity, policy enforcement, and auditing.

What platforms does Alpacon support?

Alpacon supports Linux (Ubuntu, Debian, RHEL, Rocky Linux, AlmaLinux, Oracle Linux, Amazon Linux, Fedora, SUSE, Raspberry Pi OS), Windows (Windows Server 2019 or later, Windows 10/11), and macOS 11 or later. The web interface works on current versions of Chrome, Firefox, Safari, and Edge.

Is Alpacon secure?

Yes. Alpacon uses an outbound-only tunnel architecture. No inbound ports need to be opened and no firewall rules are required. It implements zero-trust continuous verification, TLS encryption on every connection, multi-factor authentication, command ACLs, and comprehensive audit logging.

What security practices does Alpacon use?

Alpacon applies zero-trust architecture design, TLS encryption on every connection, and comprehensive audit logging. SOC 2 Type 2 is in progress, and the platform is independently penetration tested—reports are available under NDA through the trust center.

How does Alpacon handle authentication?

Alpacon uses a layered approach: users authenticate with a password and MFA, the platform issues time-limited JWT tokens, agents validate the token before allowing access, and all sessions are continuously monitored. SAML SSO, Okta, LDAP, biometrics, and hardware security keys are supported.

Can I integrate with my SSO provider?

Yes. Alpacon supports SAML 2.0 SSO and integrates with Okta, Azure AD, Google Workspace, OneLogin, and any SAML 2.0 provider. LDAP is also supported.

Get started

Let AI work on your infrastructure. Safely.

Start free

Govern what your AI agents actually execute

Most teams believe their agents are governed. Almost none can prove it.

Whoever—or whatever—touches production

AI agent operations

Team access

Vendor access management

Security & compliance

One incident, from the alert to the audit trail

Trusted with production

The latest on AlpacaX

Verification guidance exists. Turning it into a rule is still your job.

Product update: what gets decided before a command runs

Why AI governance pilots don't survive scale

Out-of-band approval: why an agent's own channel can never be the one that approves

HIPAA day-90 audit: what session expiry misses

Kubernetes access control governs access, not commands

Session-scoped sudo: bind OS-level root to a session, not a sudoers file

EU AI Act high-risk deadline moved to 2027. What didn't?

After NextRise 2026: the questions that changed

NextRise 2026: experience AI agent execution control

Agentic AI security is a stack, not a single control

Common questions

What is Alpacon?

How is Alpacon different from SSH?

Can Alpacon replace my VPN?

What platforms does Alpacon support?

Is Alpacon secure?

What security practices does Alpacon use?

How does Alpacon handle authentication?

Can I integrate with my SSO provider?

Let AI work on your infrastructure. Safely.