IDENTOS Launches PolicyArc to Strengthen Enterprise Access Control for AI
IDENTOS, a Canadian company specializing in identity, privacy, and authorization technologies, has announced the general availability of PolicyArc, a policy-based access control platform designed to help enterprises manage permissions across applications, services, and artificial intelligence systems. The solution provides security, platform engineering, and compliance teams with a centralized environment to define access policies, enforce authorization rules, and maintain auditable records of access decisions.
The launch comes as organizations increasingly deploy AI agents capable of retrieving information, executing tasks, and making decisions within enterprise environments. Although these technologies can improve operational efficiency and automate complex workflows, they also introduce new security challenges. Traditional access control systems often rely on broad, persistent permissions that may provide autonomous agents with more access than necessary.
PolicyArc is designed to address this challenge by enabling organizations to grant narrowly defined, temporary permissions based on the requirements of individual tasks. The platform aims to help enterprises adopt AI while maintaining control over sensitive information, enforcing authorization policies, and ensuring that access decisions remain transparent and accountable.
Addressing Enterprise Security Challenges in the AI Era
The IDENTOS growing use of AI agents is changing how employees and businesses interact with enterprise software. AI-powered systems can perform activities such as retrieving records, processing information, supporting business decisions, and executing workflows across multiple applications.
However, many conventional authorization frameworks were developed primarily for human users and established software services. These systems may not adequately address the need to provide autonomous agents with limited access for specific tasks and revoke those permissions when the work is completed.
Excessive or persistent permissions can increase the potential impact of compromised systems, unauthorized actions, or improperly configured AI applications. Organizations must therefore establish controls that determine not only who or what can access a resource, but also which actions are permitted, under what circumstances, and for how long.
IDENTOS cited findings from IBM and the Ponemon Institute’s 2026 Cost of a Data Breach Report, stating that 92% of organizations experiencing an AI-related breach lacked appropriate AI access controls.
PolicyArc is intended to help businesses address these risks while also improving the management of conventional access policies, which can be difficult to update, coordinate across applications, and audit consistently.
Temporary, Task-Specific Permissions for AI Agents
A central feature of PolicyArc is its ability to support controlled access delegation for AI agents. The platform allows a person to grant an AI agent a scoped, time-limited version of their own permissions.
This approach is intended to provide an agent with only the access necessary to complete an assigned task, rather than granting broad, ongoing authorization. Permissions can be revoked automatically when the task is completed or the authorized time window expires.
For example, an employee using an AI assistant to retrieve information from an enterprise application could authorize the agent to access specific resources for a defined purpose. Once the task is complete, the temporary authorization would expire, reducing the possibility of continued access beyond the original requirement.
Alec Laws, chief technology officer of IDENTOS, highlighted the limitations of traditional access control when applied to autonomous systems.
“Most systems only know how to grant broad, standing access. That’s fine for a person, but reckless for an agent,” Laws said.
He explained that PolicyArc was developed to give AI agents the precise permissions required for individual tasks, automatically remove those permissions when the work ends, and maintain a record of every access decision.
Consent-Based Authorization and Real-Time Decisions
PolicyArc incorporates consent into its authorization process, allowing access decisions to reflect what a data owner has agreed to share. Rather than relying exclusively on permissions established during login, the platform evaluates consent for each access request.
This IDENTOS capability is particularly relevant in environments where sensitive information must be shared according to specific permissions, privacy requirements, or organizational policies.
The platform also combines established identity attributes with real-time contextual information when determining whether access should be permitted.
Standing attributes can include an individual’s organizational role and whether their identity has been verified. Contextual factors can include the sensitivity of the requested resource and the current stage of a business workflow.
By evaluating these elements together, PolicyArc can allow or deny an access request or require additional verification when circumstances warrant further checks.
This IDENTOS approach enables authorization decisions to reflect changing conditions rather than relying exclusively on static permissions. It can help organizations apply more precise controls to users, services, and AI agents operating across their enterprise systems.
Centralized Policy Management Across Applications
Another key capability is centralized policy management. PolicyArc enables organizations to define rules for a resource type once and apply those policies consistently across connected applications.
This model is intended to reduce the need to create and maintain separate authorization logic for every application or integration. It can also help businesses introduce new resource types and modify existing policies without rewriting their integrations.
For organizations operating complex technology environments, maintaining consistent access rules across multiple applications can become increasingly difficult as products, workflows, and services expand.
A centralized approach can help platform and security engineering teams manage authorization more efficiently while ensuring that changes to access requirements can be implemented quickly.
According to IDENTOS, policies can be updated in minutes, allowing access controls to evolve alongside business applications and operational requirements.
The platform is designed to help organizations avoid situations in which outdated authorization rules remain in place because updating individual integrations requires significant development work.
Built-In Auditability and Compliance Support
PolicyArc automatically records access decisions, creating an audit trail that organizations can use for reporting, security reviews, and compliance activities.
Maintaining reliable records is important for businesses that must demonstrate why access was granted, whether permissions were appropriate, and how sensitive information was protected.
Without automated logging, organizations may need to reconstruct access histories from separate applications, system logs, and other records. This process can consume time and make it more difficult to establish a complete picture of authorization activity.
By making audit records available by default, PolicyArc aims to help businesses establish compliance evidence from the beginning of implementation rather than collecting information retrospectively.
The capability is intended to support teams responsible for enterprise security, risk management, regulatory compliance, and the deployment of AI-powered features.
Designed for Security, Platform, and Compliance Teams
PolicyArc targets organizations that need to manage authorization across expanding application environments while introducing AI-driven capabilities.
Platform and security engineering teams can use the solution to coordinate access policies across products and services. Compliance and risk professionals can use its audit capabilities to demonstrate how authorization decisions are made and enforced.
Meanwhile, development teams introducing AI-agent functionality can use the platform to manage delegated access without having to build an independent authorization infrastructure for every application.
Mike Cook, chief executive officer of IDENTOS, described the launch as an extension of the company’s experience in identity and access management.
“Today marks a natural evolution for IDENTOS in the era of AI,” Cook said. He explained that PolicyArc applies the company’s experience with identity and access controls to the challenge of helping enterprises adopt AI while maintaining oversight.
Availability and Company Background
PolicyArc is generally available and can be accessed through the company’s official website at https://policyarc.com/.
Powered by IDENTOS, PolicyArc serves as an authorization layer designed to manage, enforce, and document access decisions for AI agents, services, and people across existing enterprise technology environments.
IDENTOS was founded in 2014 and has spent more than a decade developing identity, privacy, and authorization technologies for sensitive enterprise systems. The company has experience serving highly regulated sectors, including healthcare and government, where dependable access controls are essential to protecting information and delivering critical services.
IDENTOS reports that it holds ISO 27001 and SOC 2 Type II certifications and builds its products with 100% Canadian data residency.
Additional information about the company and its technology is available at https://identos.com/.
With PolicyArc, IDENTOS is extending its authorization capabilities to address the growing role of AI in enterprise operations. By combining temporary permissions, consent-based access, contextual decision-making, centralized policy management, and automated auditing, the platform aims to help organizations deploy AI agents while maintaining stronger oversight of sensitive data and business systems.
Source Link: https://www.businesswire.com/