Humans, service accounts, vendors and AI agents. One map, one policy envelope, one ledger.
{"ts":"2026-10-23T09:42:14Z",
"actor":"agent","mode":"machine_speed",
"action":"end_session","target":"svc-payroll-bot",
"rule":"idle>30m","seal":"sha256:7f3a…c91e",
"prev":"sha256:b02d…4e77"}
{"ts":"2026-10-23T09:43:31Z",
"actor":"human:org.owner","mode":"checkpoint",
"action":"grant_jit_access","target":"vendor-auditor",
"ttl":"2h","seal":"sha256:1e8c…a0f3",
"prev":"sha256:7f3a…c91e"}
Illustrative ledger record. Each entry carries the hash of the one before it. The export format is a design, not a shipping file.
A CISO should know exactly what is live before trusting what is next.
The Chrome extension is the primary access point; the mobile app pairs with it. Sign in with passkeys (WebAuthn), TOTP or SMS. Credentials are encrypted on the device with AES-256 and per-user keys before they sync. Nothing arrives at Sequrely’s servers in plaintext. The lifecycle the agent will run is already in place.
Passkeys and WebAuthn by default; TOTP and SMS where a target still needs them. Sign-in is bound to authorized devices.
Share a credential to a person or a collection for a bounded window. Every share, view and revocation is recorded.
Owner, Admin, Manager and User roles, enforced server-side. Collections and groups scope who sees what.
Share requests, approvals and revocations reach the right person as they happen, on the device they hold.
Status is stated plainly so you can plan an audit around it.
Each device holds its own keypair. A master device authorizes or revokes others; a web list shows every authorized endpoint with platform, last-active and status. Envelope encryption, no server-side plaintext.
Users, services and roles in one admin view, with every admin action logged as the foundation of the evidence trail.
The agent that maintains, revokes and rotates across your authorized sessions is in research. It is gated behind a written threat model and a planned external security review before any general availability. A design-partner program is forming.
Also in development: Sequrely as a passkey provider, a desktop client, and on-device extraction of emailed MFA codes. Dates are shared with design partners, not published here.
You cannot enforce what you cannot see. The map comes before the policy, and the policy before the agent. Each tile carries its status.
Endpoints, cloud, identity logs and non-human accounts collapse into one authoritative map: every identity, human or agent, and the systems it can reach. Fragmentation is where access hides. The map is where it stops.
Non-human identities are identified explicitly, so service accounts and AI agents are mapped to least privilege instead of inherited access.
Maintain, rotate or revoke the credentials you hold in Sequrely from one place, with each action recorded. Autonomous rotation is the agent’s job.
Knowledge, possession, likeness, location and behavior score the session while it runs. Risk steps up authentication or ends the session.
Grants carry an expiry. Vendors and auditors get just-in-time, task-scoped access that revokes itself when the task ends.
A login is a point. A session is a line. Five signals keep scoring the line.
A PIN or secret only the person holds. Never the only factor.
An authorized device or hardware key, bound by a keypair that never leaves it.
Biometrics through the device’s own secure hardware. Sequrely never sees the template.
Network, geography and device context. A valid token from the wrong place is still wrong.
Drift from the identity’s digital twin: timing, scope, volume. The signal attackers cannot copy.
Knowledge, possession and likeness ship today through passkeys, TOTP and device biometrics. Location and behavior are designed for the enforcement agent and are not shipped.
Every action class is assigned a mode. The agent cannot promote itself.
The digital twin learns each identity’s normal before anything is enforced. Observe mode is the default.
The response is looked up in the policy envelope. The mode comes from the policy, never from the agent.
Machine-speed runs now. Checkpoint waits for a named approver. Human-gated produces a recommendation and stops.
Decision, evidence and mode are hashed into the ledger with the hash of the entry before.
Read the ledger, tighten or loosen the envelope. Changing the envelope is itself a logged, human-gated event.
Illustrative investigation ledger. Example row: 14:02:11, Sequrely agent, New non-human identity found · ci-runner-7 · unmapped, status Watching.
Illustrative ledger. Live telemetry is shown in product. Identifiers are fictional.
Enforcement sits beside your identity provider and your cloud IAM; it does not replace them.
System categories, not endorsements. The current connector list is available on request.
Status labels on this page are kept current. Ask for the roadmap in a demo.