---
title: "Identity and access for AI agents on Zero Trust"
description: "Duale AI gives each AI agent its own identity and least-privilege access under Zero Trust, with every change logged for your security team."
lang: en
lastUpdated: 2026-10-23
url: https://duale.ai/en/product/identity-and-access
---

<Hero
  eyebrow="Identity and access"
  title={
<>
  Give every AI agent its own identity and <AccentText>only the access you grant.</AccentText>
</>
}
  subtitle="Identity and access for AI agents, built on Zero Trust. Your security team can approve agents that act on your company's data. People and agents follow the same rules, and every access change goes to the audit log."
  primaryCta={{ label: "Plan your first use case with us", dialog: "contact" }}
  secondaryCta={{ label: "Read the identity guide", href: "https://duale.ai/en/docs/identity.md" }}
/>

<Section title="From one agent to every team" subtitle="An illustrative example: two teams, two agents and one set of access rules, approved once.">
  <CardGrid columns={3}>
    <Card title="Support starts with one agent" icon="person">
      Your support lead creates a support-triage agent and adds it to the support group. It reads the support knowledge
      in your [Libraries](https://duale.ai/en/product/libraries.md), and nothing else.
    </Card>

    <Card title="Finance adds the next agent" icon="layers">
      Your finance lead creates an invoice-review agent and adds it to the finance group. It reads the invoices it needs
      and never sees support's knowledge. Nobody rewrote a rule.
    </Card>

    <Card title="Your security team sees who did what" icon="eye">
      The audit log shows both leads' changes in order: who created each agent, and in which group. Each entry is
      timestamped and ready to review.
    </Card>
  </CardGrid>
</Section>

<Section title="Keep every access in your hands" subtitle="Grant each agent what its job needs, see every change, and keep the sensitive decisions with your people.">
  <CardGrid columns={3}>
    <Card title="Every request traced to its agent" icon="id-card">
      Each agent works under its own identity. Create one agent per job: Duale AI charges per Task, not per agent.
    </Card>

    <Card title="One set of rules to approve" icon="layers">
      Your people and your agents join the same groups and follow the same permissions. Ready-made roles get your teams
      started on day one.
    </Card>

    <Card title="Least privilege from the start" icon="lock-closed">
      A new agent reaches only its own work. It uses your [Tools](https://duale.ai/en/product/tools.md) and reads your Libraries only when
      you grant them. No one can grant more access than they hold.
    </Card>

    <Card title="Access changes within a minute" icon="lightning-bolt">
      Grant or remove a right, and the whole Platform applies the new rule.
    </Card>

    <Card title="Sensitive decisions stay with people" icon="person">
      Removing a member, retiring an agent and other sensitive changes need a person from your team, signed in with a
      passkey or a security key.
    </Card>

    <Card title="Every access change on record" icon="eye">
      The audit log shows who changed which access, and when. Export it to your SIEM. Even reads of the log are
      recorded.
    </Card>
  </CardGrid>
</Section>

<Section title="Zero Trust on every request" subtitle="Duale AI allows or refuses each request on who is asking, which action and which resource, never on where it comes from.">
  ```mermaid
  flowchart LR
      accTitle: How Duale AI checks every request
      accDescr {
        A person in your team or an AI agent sends a request. Duale AI checks who
        is asking, which action and which resource, then allows or refuses the
        request. Each access change updates your access rules and goes to the
        audit log.
      }
      Person[A person in your team]
      Agent[An AI agent]
      Check[Who is asking, which action, which resource]
      Allowed[Allowed]
      Refused[Refused]
      Change[An access change]
      Rules[Your access rules]
      Log[Audit log]
      Person --> Check
      Agent --> Check
      Check -->|right granted| Allowed
      Check -->|no right| Refused
      Change --> Rules
      Rules --> Check
      Change --> Log
  ```

  A person and an agent that hold the same right get the same answer. [See how access policies
  work](https://duale.ai/en/docs/identity/policies.md).
</Section>

<Section title="Keep each team's sensitive work with its own agents" subtitle="Each use case shows the access its agents get, set per team or per client.">
  <CardGrid columns={3}>
    <Card title="Sales" icon="file-text" href="https://duale.ai/en/use-cases/sales.md">
      Give each client its own agent, with access to that client's questionnaires and records only.
    </Card>

    <Card title="Legal" icon="reader" href="https://duale.ai/en/use-cases/legal.md">
      Keep your contracts within reach of your legal team and its agents only.
    </Card>

    <Card title="IT and security" icon="lock-closed" href="https://duale.ai/en/use-cases/it-and-security.md">
      Decide which systems your security agent may reach, and keep its findings away from other teams' agents.
    </Card>
  </CardGrid>
</Section>

<Section title="Before you create your first agent">
  <CardGrid columns={2}>
    <Card title="One fixed price per Task" icon="check">
      A standard Task costs €0.10 and a fast Task €0.20, excluding VAT. [See pricing](https://duale.ai/en/product/pricing.md)
    </Card>

    <Card title="Your choice of hosting" icon="globe">
      Use the managed service, hosted in the European Union, or run the Platform in your own infrastructure.
    </Card>

    <Card title="Encrypted storage" icon="lock-closed">
      All stored data is encrypted, from Library files to database backups.
    </Card>

    <Card title="Unlimited agents" icon="person">
      Add agents as your teams and use cases grow.
    </Card>
  </CardGrid>

  Your security team can review the rest of the controls in the [Trust Center](https://duale.ai/en/product/security.md).
</Section>

## Identity and access questions

### Who issues the credentials when teams create their own agents

The people you choose, such as your platform team. A team lead can create and update the team's agents, but not
issue their credentials. [Read the agent credential
guide](https://duale.ai/en/docs/identity/credentials-and-lifecycle.md#check-the-permission-for-each-lifecycle-operation).

### Can we define our own access roles for agents and teams

Yes, to match your own teams and projects. [See how legal keeps contracts to its own agents](https://duale.ai/en/use-cases/legal.md),
and [read the access policy guide](https://duale.ai/en/docs/identity/policies.md#author-a-narrow-tenant-policy).

### Does renewing an agent's credential stop its work

No. The agent keeps working on its current credential while the new one takes over. [See how to renew a
credential](https://duale.ai/en/docs/identity/credentials-and-lifecycle.md#rotate-an-api-token-before-you-revoke-it).

### Can an agent pass itself off as someone else

No. Nothing in a request can make an agent act as a person or as another agent. [See the authorization controls in
the Trust Center](https://duale.ai/en/product/security.md), and [see how Duale AI tells people and agents
apart](https://duale.ai/en/docs/identity.md#distinguish-the-two-tenant-identities).

### Can we bring back an agent retired by mistake

Yes. A person you grant the right can recover a retired agent, and the access rules written for it apply again.
[Read how to retire and recover an
agent](https://duale.ai/en/docs/identity/credentials-and-lifecycle.md#revoke-every-token-before-you-delete-the-identity).

<Cta title="Set your access model once. Let every team build on it." primaryCta={{ label: "Plan your first use case with us", dialog: "contact" }} secondaryCta={{ label: "Read the identity guide", href: "https://duale.ai/en/docs/identity.md" }} />

## Related content

- [Security controls for your agent platform](https://duale.ai/en/product/security.md)
- [IT and security: alerts classified with evidence](https://duale.ai/en/use-cases/it-and-security.md)
- [Legal teams: every point quoted, ready for decision](https://duale.ai/en/use-cases/legal.md)
- [Agent Identity credentials and lifecycle](https://duale.ai/en/docs/identity/credentials-and-lifecycle.md)
- [AI that takes on real work, with and for your people](https://duale.ai/index.md)
- [Sales: bids and briefs sourced before the deadline](https://duale.ai/en/use-cases/sales.md)

---

## Sitemap

See the full [Markdown sitemap](https://duale.ai/sitemap.md) for all pages.