Security
Agents on real systems, without taking anyone's word for it.
The moment an agent can act on production, the question stops being what a model might say and becomes what it is permitted to do. This is how that is decided, enforced and evidenced.
Posture
Where it runs, and what it never holds.
Most of the security question is answered by architecture rather than by features.
It runs on your infrastructure
Docker, Kubernetes or bare metal, inside your network and in front of your own MCP servers. There is no shared tenancy to reason about and no data aggregation on our side.
Your identity provider stays the authority
OIDC and SAML SSO with SCIM provisioning and just-in-time user creation. Palma is not an IdP and does not want to be one — it reads the groups you already maintain.
Credentials are not handed out
Seven outbound strategies, including RFC 8693 token exchange and vault-held credentials, so a downstream system can be reached without its secret ever reaching an agent or a user.
On every call
Attribution is not optional.
A shared service account is where accountability goes to die. Every request through Palma carries all three principals, so the answer to “who did this” is a person — and the answer to “what happened” includes the calls that were stopped.
- User
- Agent
- Host client
Controls
What is enforced at the call.
Every one of these applies before the request reaches your system, at the single point every agent-to-tool call passes through.
Least privilege, by construction
A tool an identity is not entitled to is not listed to that identity. Access is decided by subject, group and token issuer, before anything is offered.
Approval for the actions that warrant it
High-risk calls pause for a named approver mid-flight instead of failing silently or proceeding quietly.
Argument-level rules
Policies decide on the contents of a request, not just its name — so a permitted capability can still be stopped on a specific value.
Rate limits at the gateway
A looping agent is contained at the point of the call, before it becomes an incident downstream.
Secrets stripped from Skills
Redaction runs before a Skill version is stored, and scanning blocks versions carrying injection, exfiltration or privilege-escalation patterns.
Scoped visibility for resources
Tenant-wide, private by ownership chain, or restricted to a need-to-know allowlist — chosen per resource rather than assumed.
Evidence
An audit trail a reviewer can actually read.
Each entry names the person, the agent acting for them and the client it arrived through, alongside the tool, the server and the outcome. Failures carry their reason rather than a status code.
- User, agent and host client on every call
- Denials and rate-limit stops recorded alongside successes
- Filterable by space, agent, server and status across the org
Attribution
Who did this, answered properly.
Shared service accounts are how attribution dies. Every call carries the chain that produced it.
Three principals on every entry
The user, the agent acting for them, and the client it came through. "Who did this" resolves to people, not to a service account.
Control-plane changes are tracked
Configuration changes are recorded with diffs, so a change to the rules is as reviewable as a call made under them.
Readable by your reviewer
Activity filters by space, agent, server and status across the organisation, so an auditor can answer their own question without a walkthrough.
Book a demo
See what governed AI agents look like.
A 20-minute demo on your stack. We'll show Palma working with the agents, tools and identity provider you already run.
- Enterprise security
- Role-based access
- Instant integration
Latest Blog Posts
Stay up-to-date with the latest in enterprise AI, MCP servers, and secure integration strategies.
