KeyForge AI
Continuous Identity Security Platform

Continuous identity governance for humans, machines & AI agents.

Automate access decisions, detect identity risk, and continuously govern entitlements across enterprise applications, cloud infrastructure, service accounts and AI agents.

Application access governance, non-human identity security and agentic AI security — on an IGA and continuous assurance foundation. Run it standalone, or extend the IGA you already own.

The portfolio

One platform. Five identity security products.

Five entry points for buyers, built on one governance foundation — not five separately deployed tools with separate data.

Where KeyForge AI differentiates

Foundation and assurance

Shared platform foundation
  • Identity Graph
  • Policy Engine
  • Risk Analytics
  • Workflows
  • Connectors
  • Audit Evidence
Explore the platform

Flagship · Application Access Governance

Govern what users can actually do — across applications.

Create Payments lives in the ERP. Finance File-Share Admin lives in the directory. Each is a reasonable grant, approved by a different team, and neither system can see the combination. One rule spans both.

Rule builder defining a cross-application segregation of duties rule spanning an ERP and a directory
Rule definition — stated in plain language, scored and scoped
Cross-application segregation of duties ruleset listing seven rules spanning ERP, directory and API systems
Cross-application ruleset — ERP × directory × API
Rules evaluate the effective permission — after inheritance and nesting are resolved — then normalise it across platforms. Once an EBS function, a Fusion privilege, a SAP authorization value and a directory group are the same kind of object, one rule can span all of them.

Non-human identity & agentic AI security

Secure the identities that act without a person behind them.

Service accounts, API keys, certificates and AI agents already outnumber employees — and hold real transactional authority. KeyForge AI gives each one an owner, a scope, an expiry and an evidence trail, under the same policies that govern people.

MCP registry showing six registered servers and the tool catalog for an SAP procure-to-pay server with per-tool risk, side effect and human-in-the-loop flags
MCP registry — server lifecycle, tool catalog, drift detection and ownership

Why KeyForge AI

Observe. Reason. Govern. Assure.

Continuous Identity Reasoning is the architecture underneath all five products: deterministic policy first, every outcome traceable to a named rule, and no generative AI in the decision path unless you switch it on.

01 · Execution chain

Observe

Every identity, entitlement, tool call and the principal it acted as — captured as a connected chain rather than scattered logs.
02 · Every decision

Reason

Identity, intent, context, risk and policy evaluated together, continuously, at each decision point.
03 · Identity lifecycle

Govern

Ownership, scope, rotation, expiry and certification applied uniformly to people, service accounts and agents.
04 · Every transaction

Assure

A durable record of who authorised what, under which policy, with which approval — generated at decision time.

How it works

Signals in. Evidence out.

Continuous Identity Assurance turns a signal into a governed event with an owner, an SLA, a decision, a remediation and an audit trail behind every state change.

  1. 1

    Signals

    Detection

    Entitlement, HR, usage and runtime events arrive from the systems you already run.

  2. 2

    Reasoning

    Policy

    Risk, peer comparison, blast radius and policy evaluated together against a versioned rule.

  3. 3

    Decision

    Judgement

    Revoke, approve with mitigation, accept risk or dismiss — signed, with evidence required.

  4. 4

    Remediation

    Action

    Executed against the target system automatically or by a reviewer, with a rollback path.

  5. 5

    Evidence

    Assurance

    Every state transition written to an immutable audit record you can reproduce months later.

Events move OPEN → IN_REVIEW → DECIDED → MITIGATING → REMEDIATING → CLOSED. Transitions are enforced server-side — reviewers cannot skip states, and every transition writes an audit record.

Integration ecosystem

Works across your enterprise identity ecosystem.

Pre-built connectors for major ERP, directory, cloud and SaaS platforms, plus AI self-discovery connectors that onboard REST and database applications in minutes rather than days.

Browse the integration catalog

Start with your own estate, not a slide deck.

Book a technical demo mapped to the applications you run, or score your governance programme in five minutes first.