Alter (YC S25) Launches a Proxy to Stop Agents Sharing One API Key

Alter, a Y Combinator Summer 2025 company, launched on Hacker News on Oct. 21 with a product that sits between an AI agent and the systems it calls, so that an agent acting for one employee cannot use another employee's access. The Launch HN post reached 68 points. It launches with a free tier of 10,000 requests, a SOC 2 audit still in its observation window and a source release that has not happened.

The problem Alter says it solves

Founder Srikar Dandamuraju and his co-founder Kevan described the failure in the post: employees sign in to an internal agent through Slack with their own accounts, but the agent reaches the CRM or billing system with one shared API key. That key can do whatever the agent can, so the user-level login controls nothing downstream.

Alter acts as a proxy for every request the agent makes. It holds the downstream credentials, attaches the identity of the person the agent is acting for, applies runtime policies and writes audit logs. The founders' launch page on Y Combinator's site says it applies role-based and attribute-based access rules down to the parameter and issues short-lived, narrowly scoped tokens. It lists MCP, the Model Context Protocol for connecting agents to tools, and native tools as supported, with agent-to-agent calls marked "coming soon."

Alter's own site claims 140 integrations, with logos including Slack, GitHub, Salesforce and Stripe, and describes the policy engine as "deny by default." It lists no pricing and offers a demo booking. The launch page names no customers. In the thread, the founders cited an internal multi-user OpenClaw for their own go-to-market work, startups building site-reliability and back-office agents, and a defense contractor building air-gapped agents. None is named.

What the thread pushed back on

The comments ran longer than the pitch, and the founders conceded several gaps.

Question raised	Founders' answer in the thread
SOC 2 status	Type 2 audit in its observation period, not yet certified
Source code	Planned to be open-sourced, not released
mTLS between agent and proxy	Not offered yet
Per-user rolling spend budgets	Not built; per-agent call quotas exist
Credentials Alter does not hold	An agent can still use them directly

The compliance language does not line up across Alter's own pages. The company's site says "SOC 2 in progress" and reports an independent penetration test within the last 12 months. The Y Combinator page says the product supports SOC 2, HIPAA and GDPR compliance, which is a different claim from holding a certificate. The founders also said they had run two penetration tests.

Two commenters, mauvehed and jeswin, called the site a template that looked generated and argued that an access-control product is hard to trust without source access. jeswin suggested citing SOC 2 Type I if one exists. The founders pointed to the trust page and said the source would be released.

Another commenter asked how a proxy-based design stops an agent from skipping the proxy. Kevan said the agent holds no provider credentials, so a direct call fails, and that credentials are injected only into allowlisted hosts. He added that customers must lock down network egress on their side. A separate commenter, heyvaldemar, said that in their own testing 7 of 10 permission checks failed until identity was passed through, and that the fix was enforcing ownership at the tool server.

Where it sits among agent-security tools

Agent identity is turning into a product category with several entrants. Nvidia's OpenShell sandboxes what an agent can touch on a machine, while Alter controls what a request can do once it leaves. Another Y Combinator company, Laminar, records what agents did after the fact. A commenter asked why not use a secrets manager such as Infisical; the founders replied that Infisical stores secrets while Alter maps an end user's identity to a credential and logs the decision.

Alter has not disclosed funding, headcount or any paying customer, and the thread did not ask. The next checkable events are the SOC 2 Type 2 report, which would end the observation window, and the open-source release the founders promised.