Fintra Feature
Okta for the AI runtime
AI Runtime Identity
Example figures- AGENTS
- 41 identities
- enveloped
- JIT CREDS
- ephemeral
- scoped, expiring
- FINDINGS
- 2 orphans
- 1 elevation
- reconciler-agent: Tier 2
- scoped, owned
- JIT credential: expires in 14m
- least privilege
- Orphaned identity: no owner
- flagged
- Standing elevation detected
- revoke ↗
- Temporary elevate, then auto-revoke
- time-boxed
An identity envelope for every agent
An agent holding a shared, standing API key is an unowned, unbounded identity: exactly what access reviews exist to catch among humans. Fintra makes each agent a first-class identity: durable, owned, and bounded by a tier that says what it is allowed to do.
- Identity envelopes: each agent has a durable identity, a named owner, and a tier that bounds what it can reach
- Tiers: higher-risk capabilities require a higher tier, so scope is explicit rather than implicit
- JIT credentials: agents receive ephemeral, narrowly scoped credentials that expire on their own
- Detection: orphaned identities (no owner) and standing elevations are surfaced for cleanup
- Temporary elevate/revoke: raise privilege for a single task, time-boxed, then auto-revoke
JIT credentials and standing-privilege detection
The lifecycle of agent access
Envelope
An agent is registered with an identity, an owner and a tier: the runtime equivalent of a user record.
Issue JIT
For a task, the agent receives an ephemeral, narrowly scoped credential that expires on its own.
Detect
Orphaned identities and standing elevations are flagged, the way access reviews catch dormant human accounts.
Elevate & revoke
Need more for one job? Elevate temporarily; the grant is time-boxed and revoked automatically.
What it is, and what it isn’t
Questions people ask
What is a runtime identity envelope for an AI agent?
A durable, DB-persisted identity for an agent (who it is, its owner, and the tier that bounds what it can do) so an agent is a governed identity rather than an anonymous holder of a shared API key.
What are JIT credentials for agents?
Just-in-time, ephemeral, narrowly scoped credentials issued for a specific task and set to expire on their own, so agents operate at least privilege instead of holding standing keys that outlive the work.
How does it catch over-privileged agents?
It detects orphaned identities that have no owner and standing elevations that were never rolled back, and it supports temporary, time-boxed elevation that auto-revokes: the runtime analogue of a human access review.
Is this a replacement for Okta or my IdP?
No. It applies Okta-style identity discipline to AI agents inside Fintra’s runtime (envelopes, tiers, JIT credentials, orphan and elevation detection) but it is not an org-wide identity provider or a federation broker for every system you run.
Is it real or a mock?
Real and DB-persisted. The identity envelopes, tiers, JIT credentials and detection findings are stored and inspectable, not illustrative placeholders.
Keep reading
Calculators
One finance briefing a week
New guides, checklists and benchmarks, by email. Unsubscribe from any issue.
See the security depth, not the slideware
Walk the SOC engine, the governed MCP server, and the control graph live, with the honest caveats on the table, not hidden.