AI-native PAM

Govern what your AI agents actually execute

Other tools give agents access. Alpacon judges every command your agents run—before it runs.

Start free

alpacon.io/demo/approvals

The agent asked

sudo docker exec payments-wsgi-1 python manage.py dumpdata clients.ApiClient

Work sessionSeed the staging billing ACL

svc-incident-bot2 minutes agoAI agent

Alpacon decided

Medium riskAwaiting approval

AI review held it: dumping API client credentials (client_id, secret) does not serve the session's stated goal of seeding ACL rows. No policy auto-releases an AI hold—only a person can.

Command does not plausibly serve the work_session description
Running as root

The agent asked

sudo docker exec payments-wsgi-1 python manage.py dumpdata clients.ApiClient

Work sessionSeed the staging billing ACL

svc-incident-bot2 minutes agoAI agent

Alpacon decided

Medium riskApproved

AI review held it: dumping API client credentials (client_id, secret) does not serve the session's stated goal of seeding ACL rows. No policy auto-releases an AI hold—only a person can.

Command does not plausibly serve the work_session description
Running as root

Authorized. The run lands on the record.

The agent asked

sudo docker exec payments-wsgi-1 python manage.py dumpdata clients.ApiClient

Work sessionSeed the staging billing ACL

svc-incident-bot2 minutes agoAI agent

Alpacon decided

Medium riskRejected

AI review held it: dumping API client credentials (client_id, secret) does not serve the session's stated goal of seeding ACL rows. No policy auto-releases an AI hold—only a person can.

Command does not plausibly serve the work_session description
Running as root

Rejected. The denial lands on the record.

The agent asked

sudo docker exec payments-wsgi-1 python manage.py dumpdata clients.ApiClient

Work sessionSeed the staging billing ACL

svc-incident-bot2 minutes agoAI agent

Alpacon decided

Medium riskAwaiting approval

AI review held it: dumping API client credentials (client_id, secret) does not serve the session's stated goal of seeding ACL rows. No policy auto-releases an AI hold—only a person can.

Command does not plausibly serve the work_session description
Running as root

Trusted by the most security-demanding organizations and fast-growing teams.

Our customers

Backed by · Partners

Rabbit Ventures

SOC 2 Type 2 in progress

Independently penetration tested

Trust center

The governance gap

Most teams believe their agents are governed. Almost none can prove it.

The gap is not malice. It is missing evidence at the execution layer.

Who's asking

AI agents
Engineers
CI/CD pipelines
Vendors

Alpacon · execution control

Judged before it runs

Allow
Hold for a human
Deny

Agent and sudo commands, judged against the session's declared purpose and security risk.

reaches the host

never does

Your servers

Everything that happened lands on the timeline—every command, work session, and approval.

One control plane · four jobs

Whoever—or whatever—touches production

AI agent operations

Claude, Cursor and your SRE bots debug, deploy and remediate on prod. Alpacon keeps them in bounds.

Scope agent access with command-level control
Approve privileged operations from Slack
Full audit trail for every agent action

Learn more

Team access

Hundreds of servers, one login, just-in-time access without standing credentials.

Access any server from your browser—nothing to install
Edit, transfer, and troubleshoot in one place
Ditch password sprawl—one login, every server

Explore team access

Vendor access management

Vendors get the exact hosts they need, time-boxed and recorded. No lingering VPN accounts.

Grant scoped access that expires with the session
Judge privileged commands against scope before they run
Show an auditor one record per session

Explore vendor access management

Security & compliance

Answer an auditor in one query. Outbound-only architecture, every session on one queryable timeline.

AI-powered threat detection with risk scoring
Zero open ports—outbound-only architecture
One filterable timeline per session—commands, transfers, sudo

See the security overview

How it works

One incident, from the alert to the audit trail

A monitoring alert lands, an agent picks it up, and a record is what is left at the end.

None of it matches a policy hold, so the investigation runs at agent speed and nobody gets paged.

alpacon.io/demo/work-sessions/ws-3417/commands

Commands in this session

prod-docker-1

journalctl -u payments-api --since -15m | grep 500Allowedjudged · in scope
docker ps --filter name=paymentsAllowedjudged · in scope
psql -c "SELECT count(*) FROM payment_intents WHERE status='pending'"Allowedjudged · in scope

The reads are judged too. They pass because no policy holds them, not because reads are exempt.

The one command that outruns the declared purpose is the one that stops.

alpacon.io/demo/work-sessions/ws-3417/commands

Commands in this session

prod-docker-1

journalctl -u payments-api --since -15m | grep 500Allowedjudged · in scope
docker ps --filter name=paymentsAllowedjudged · in scope
psql -c "SELECT count(*) FROM payment_intents WHERE status='pending'"Allowedjudged · in scope
sudo -u postgres psql -c "ALTER TABLE payment_intents ADD COLUMN idempotency_key text"Held
Medium riskRouted to an approver
The session was opened to investigate, not to change the schema. AI review held the DDL write as outside the purpose the session declared, and no policy releases an AI hold—only a person can.
- Command does not plausibly serve the work_session description

The approver decides where they already are—no console to open.

incident-payments

Slack

AlpaconAPP09:47

Approval requested: a command is held on work session ws-3417.

Command: sudo -u postgres psql -c "ALTER TABLE payment_intents ADD COLUMN idempotency_key text"
Risk: Medium risk
Session purpose: Investigate the payments-api 500s
Requested by: claude-codeAI agent

incident-payments

Slack

AlpaconAPP09:47

Approval requested: a command is held on work session ws-3417.

Command: sudo -u postgres psql -c "ALTER TABLE payment_intents ADD COLUMN idempotency_key text"
Risk: Medium risk
Session purpose: Investigate the payments-api 500s
Requested by: claude-codeAI agent

Approved by Eunyoung Jeong

incident-payments

Slack

AlpaconAPP09:47

Approval requested: a command is held on work session ws-3417.

Command: sudo -u postgres psql -c "ALTER TABLE payment_intents ADD COLUMN idempotency_key text"
Risk: Medium risk
Session purpose: Investigate the payments-api 500s
Requested by: claude-codeAI agent

Denied by Eunyoung Jeong—the command never ran, and the denial is on the record.

Nothing to assemble afterwards.

alpacon.io/demo/work-sessions/ws-3417/timeline

Session ws-3417 timeline

22 min

09:41Work session openedclaude-code · purpose: investigate the payments-api 500s · scope: command, privilege elevation
09:433 commands allowedjudged, in scope, no policy hold
09:471 command heldALTER TABLE payment_intents · medium risk · outside the declared purpose
09:49Approved by Eunyoung Jeongdecided in Slack, two minutes after the hold
09:49Command executedran as postgres on prod-docker-1 · exit 0
10:03Work session closedscope released; the agent keeps nothing

Everything that happened lands on the timeline. Twenty-two minutes end to end—a person was needed for two of them.

Your monitoring fires first—Alpacon is nowhere in this picture yet.

DatadogMonitor alert

payments-api 5xx rate above threshold

payments-api · 5xx rate 4.2% · us-east-1

09:41

5xx rate · last 30 min

On-call hands the incident toclaude-codeAI agent

See how it works

Trusted with production

“Our Claude Code and Codex get their access through Alpacon and work on our infrastructure every day—deploys, debugging, fixes—and the whole team moves faster for it. We let them run unsupervised—and can prove exactly what they did.”
Director of EngineeringStartup
“We ran GPU cluster experiments through our GitLab pipeline and Alpacon CLI—no firewall rules, no SSH keys, no VPN. Alpacon handled secure access to every node, and our tests just worked.”
Principal ResearcherResearch Institute

Resources