IDENTOS PolicyArc GA offers time-limited access for AI agents

IDENTOS has announced that its PolicyArc platform is now generally available. The solution provides security, platform, and compliance teams with a centralized location to define, enforce, and audit access policies across their application environments.

The tool is designed to address the specific challenges of granting access to AI agents that operate within organizational systems. Traditional access control mechanisms were not built to provide agents with the precise, temporary permissions required for specific tasks, often resulting in overly broad or persistent access privileges.

Context and Background

PolicyArc builds on more than twelve years of IDENTOS experience in identity and access management within Canadian government and healthcare systems. According to Help Net Security, the platform aims to solve the difficulty of safely extending access to AI agents that act on behalf of users, pulling data and making decisions inside company systems.

A major driver for this release is the lack of proper controls for AI. According to IBM and Ponemon Institute’s 2026 Cost of a Data Breach Report, 92% of organizations that experienced an AI-related data breach lacked proper AI access controls. PolicyArc is designed to mitigate this risk while also addressing the slower, less auditable nature of traditional access policy management.

Who Is Affected

Security, platform, and compliance teams managing applications that utilize AI agents are the primary audience for this tool. Organizations adopting AI agents that interact with internal data and workflows face increased risk if those agents hold persistent or unscoped access rights that exceed their immediate operational needs.

The platform allows people to grant AI agents a scoped, time-limited version of their own access. This permission is sufficient for the agent to complete its assigned job and is automatically revoked when the specific task or time window ends, reducing the attack surface associated with long-lived credentials.

What should you do?

Organizations should evaluate their current access controls for AI agents and automated services. Review existing permissions to ensure they follow the principle of least privilege and are time-bound. Monitor audit logs for AI agent activity to detect anomalies. Plan for policy updates that can be applied consistently across all connected applications without requiring code changes.

What to do and how to stay safe: IDENTOS

• Audit current access permissions granted to AI agents and automated scripts to identify overly broad or persistent rights.
• Implement time-limited access tokens for AI agents that automatically expire after a task is completed or a set duration elapses.
• Ensure every access request by an AI agent is logged and reportable to maintain a clear audit trail for compliance purposes.
• Verify that access decisions are based on real-time context, such as workflow stage and resource sensitivity, rather than static role assignments alone.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the main purpose of IDENTOS PolicyArc?

PolicyArc provides a single place to define, enforce, and audit access policies, specifically designed to safely extend scoped, time-limited access to AI agents.

Why is access control for AI agents important?

According to IBM and Ponemon Institute, 92% of organizations that suffered an AI-related data breach lacked proper AI access controls, highlighting a significant security gap.

How does PolicyArc handle access revocation?

Access granted to AI agents is time-limited and automatically revoked when the specific task or designated time window ends, preventing persistent unauthorized access.