AI agent identity platform, derived from the person it works for.
Each agent’s identity comes from the employee it works for. The agent never holds their credentials.
The Hawcx console shows the Sales agent's identity: it works for Sam, a verified person who signs in with Hawcx passwordless, its identity is derived from Sam's sign-in, and it runs under the sales policy. Its last request, read an account, was allowed because it was acting for Sam and within the sales policy.
It acts for Sam.
Never as Sam.
Everything the agent changes is recorded as the agent, acting for Sam. Sam’s own sign-in is never used.
Sam, signed in with Hawcx passwordless, viewed Account 042 at 09:12. The activity is recorded as Sam.
At 09:15 the Sales agent, acting for Sam, changed Account 042's seats from 120 to 140. Hawcx allowed it, and it is recorded as the Sales agent acting for Sam. Sam's own credentials were not used.
Identity questions, answered.
Do we have to replace Okta or Microsoft Entra ID?
No. Hawcx works alongside the identity provider you already run. The employee behind an agent can sign in with Okta, Microsoft Entra ID or Hawcx passwordless, and the agent's identity is derived from that person.
How is an owner different from a human root of trust?
An owner is a name recorded against an agent, and it can go stale or be filled in after the agent is already running. A human root of trust is the person the agent's identity is derived from. It is part of the identity from the start, so every call the agent makes traces back to that person.
Which agents get an identity?
Every agent Hawcx governs: the agents your employees use, the agents your teams build, and agents found running without one once someone enrols them. Each gets its own identity, derived from one person.
Does the agent ever hold the employee's password or keys?
No. The agent acts for them, never as them. The employee's password, keys and sign-in stay with the employee, and nothing of theirs is stored in the agent.
What happens to an agent when its person leaves?
The agent's identity is derived from that person, so when they are removed in your identity provider, the agents that act for them stop too.