Hawcx for Enterprise

Enterprise identity for AI agents and people. Governed across teams. Signed in without passwords.

One policy for every team's agents, a signed receipt for every permitted action, and passwordless sign-in alongside the identity provider you already run.

Book a demo Request security docs
  • Cedar policy on every tool call
  • Signed receipts for your auditors
  • Passwordless SAML SSO for Entra ID and Google Workspace
  • SOC 2 Type II
Illustration: AI agents across eight teams at Acme. Each tool call is allowed, held for a person, or denied.

Evidence

The questions your auditors will ask.
Answered on every receipt.

Each permitted action leaves a signed receipt: which agent acted, for whom, under which policy, and who approved it.

  1. Who does this agent answer to?

    A verified person. Each agent's identity is derived from its owner. Agent identity

  2. What was it allowed to do?

    Policy checked the tool call against its trust tier before it ran. Authorization

  3. Who approved it?

    A named person, before the action ran. Human approvals

  4. Can we prove it?

    Each permitted action is signed. Hand the receipt to your auditor. Audit

Receipts are evidence, not a certification.

A signed receipt for one production deploy: agent ag_deploy_003 acted for priya@acme.example, policy held the call, Priya approved it at 14:02 UTC, and the signature verifies.

HAWCX

Signed receipt

rcpt_9c41…e07b

agentag_deploy_003 · Deploys

on behalf ofpriya@acme.example

tierL4 · Privileged admin

tool calldeploy:prod · payments-api

policyHOLD · production deploy

approved bypriya@acme.example · 14:02 UTC

decisionALLOW

signature3f9a 1c07 88be 42d1 … e07b

✓ verified

APPROVEDpriya@acme.example · 14:02 UTC

rcpt_9c41…e07b

Fleet governance

Limits set once, per tier.
Builders keep shipping.

Security sets a cap for each trust tier. Platform teams connect agents through MCP, CrewAI or OpenShell, and every tool call is checked against the same policy.

AI agent governance
L2 · READ-ONLYL3 · SCOPED WRITEag_legal_005 · revokedauthority endedL4 · PRIVILEGED ADMINpolicy cappolicy cappolicy capag_support_004Supportag_recon_002Reconciliationag_legal_005Legalag_billing_001Billingag_deploy_003Deploysread_invoice · ALLOWdelete_customer · DENYabove L2 capMCPCrewAIOpenShellPlatform teamsconnect agents hereSecurity sets one cap per tier.One policy set, checked on every tool call. L4 · PRIVILEGED ADMINpolicy capL3 · SCOPED WRITEpolicy capL2 · READ-ONLYpolicy capag_deploy_003Deploysag_billing_001Billingag_legal_005Legalag_support_004Supportag_recon_002ReconciliationMCPCrewAIOpenShellPlatform teams connect agents here
Section drawing of three trust tiers as steps, L2 read-only, L3 scoped write and L4 privileged admin, each under a dashed policy cap set by security. Acme's agents stand on their steps: ag_billing_001 reads an invoice under its cap and is allowed, ag_support_004 tries delete_customer above the L2 cap and is denied at the line, and ag_legal_005 is revoked so its authority ends. MCP, CrewAI and OpenShell sit on the ground, where platform teams connect agents.

For security and risk teams

For platform and AI teams

Workforce sign-in

Your directory stays.
Passwords go.

Hawcx acts as a passwordless SAML identity provider federated with Microsoft Entra ID or Google Workspace, so employees unlock their apps with a biometric or device PIN.

Passwordless SSO

Customer login too: six SDKs plus WordPress. Passwordless login for customers

Priced per monthly active user · Pricing

EMPLOYEE DEVICESIGN-INYOUR DIRECTORYYOUR APPSsigned infederatedassertion signedEmployee appsMicrosoft Entra IDGoogle WorkspacePasswordHawcx · passwordless SAMLidentity providerBiometric or device PIN ·device-bound keydana@acme.example EMPLOYEE DEVICESIGN-INYOUR DIRECTORYYOUR APPSsigned infederatedassertion signedEmployee appsMicrosoft Entra IDGoogle WorkspacePasswordHawcx · passwordlessSAML identity providerBiometric or device PIN ·device-bound keydana@acme.example
Your directory stays in place.

Security and deployment

Security, drawn plainly.
Where each control lives.

One reference sheet for your reviewers: what runs in your cloud, what Hawcx operates, and what never leaves the device.

Request security docs
YOUR CLOUDHAWCX CONTROL PLANEYOUR IDENTITY PROVIDEREMPLOYEE DEVICESag_billing_001ag_recon_002ag_deploy_003ag_support_004ag_legal_005billing-tools (MCP)deploy-apisupport-deskPolicy · CedarApprovalsReceiptsMicrosoft Entra IDGoogle Workspacedevice-bound keysdecision + receiptSAML · workforce sign-inALLOWHOLD123456Hawcx checkAcme × Hawcxreference deploymentSHEETSEC-01SCALENot to scaleIllustrative. Deployment options and dataresidency are agreed per contract.SOC 2TYPE II YOUR CLOUDHAWCX CONTROL PLANEYOUR IDENTITY PROVIDEREMPLOYEE DEVICESag_billing_001ag_recon_002ag_deploy_003ag_support_004ag_legal_005billing-tools (MCP)deploy-apisupport-deskALLOWHOLDPolicy · CedarApprovalsReceiptsMicrosoft Entra IDGoogle Workspacedevice-bound keysdecision + receiptSAML · workforce sign-in536124Hawcx check
Reference deployment sheet SEC-01 for Acme and Hawcx, illustrative. Acme's five agents run in your cloud and call billing-tools (MCP), deploy-api and support-desk; a Hawcx check sits at the door of each service. Only a decision and a receipt cross to the Hawcx control plane, which holds Policy (Cedar), Approvals and Receipts. Employees sign in from their devices with device-bound keys, over SAML to Microsoft Entra ID or Google Workspace. The title block carries a SOC 2 Type II seal. Deployment options and data residency are agreed per contract.

Notes · SEC-01

  1. Proof made on the device
  2. Biometrics stay on the device
  3. No central credential store
  4. Default deny for agents
  5. OAuth 2.1 at the MCP boundary
  6. Built to support NIST post-quantum algorithms

Legend

  • Tool call inside your cloud
  • Crosses a boundary
  • Boundary

Integrate

Passwordless SAML SSO for Microsoft Entra ID and Google Workspace. MCP, CrewAI and OpenShell for agents. Works alongside your identity provider.

Support

Onboarding and pilot support, a named technical contact, and uptime and response times written into your order form.

Rollout

Start with one workflow.
Expand when the evidence is in.

The rollout drawn as one track: it passes four gates, scope, pilot, security review and expand, picking up what each stage produces, then opens into six lanes, one for each agent team and for workforce and customer sign-in.

  1. Scope

    Pick one agent workflow with real risk, such as refunds or deploys, or one app to move to passwordless sign-in.

    • one workflow
    • deploy:prod

  2. Pilot

    Enroll the agents, write the policy, route sensitive actions to approvers, and review the receipts.

    • policy written
    • approvers set
    • receipts reviewed

  3. Security review

    Your reviewers get the SOC 2 report, architecture notes and a data-flow diagram.

    • SOC 2 report
    • architecture notes
    • data-flow diagram

  4. Expand

    Add agents and teams, and move employees to passwordless SSO through Entra ID or Google Workspace.

  • Billing agents
  • Deploy agents
  • Support agents
  • Legal agents
  • Workforce SSO
  • Customer login

Enterprise questions, answered.

Security & trust Pricing Book a demo
How does Hawcx work across many teams?

Security sets trust tiers and one policy set. Each team connects its agents through MCP, CrewAI or OpenShell. Sensitive actions wait for a named person, every permitted action is signed, and any agent can be revoked from one place.

Does Hawcx replace Okta, Microsoft Entra ID or Google Workspace?

No. For AI agents, Hawcx adds per-action authorization, human approvals and signed receipts next to your identity provider. For workforce sign-in, Hawcx can act as a passwordless SAML identity provider federated with Microsoft Entra ID or Google Workspace, so your directory stays in place.

What evidence can we give auditors about agent actions?

Each permitted action produces a signed receipt, and sensitive actions can be held for a named person to approve or reject. Hawcx provides evidence. It does not certify compliance with any regulation.

Can our security team review Hawcx?

Yes. Request our security documentation, and we will share what applies to your review, including the SOC 2 Type II report under NDA.

How is Hawcx deployed, and what support comes with an enterprise plan?

Deployment and support terms are agreed per contract, including deployment options, data residency, uptime and response times. Book a demo to discuss your requirements.

How is enterprise pricing structured?

Passwordless authentication is priced per monthly active user. For AI agent pricing, book a demo.

What do we need for procurement?

MSA, DPA and security questionnaire support on request.

Choose how to start.Self-serve, or a guided rollout.

Start with passwordless

Self-serve, phishing-resistant sign-in for your apps.

  • Six SDKs plus WordPress
  • Docs and quickstarts
Read the docs
A security review packet prepared for acme.example and marked Under NDA, with index tabs for the SOC 2 Type II report, the penetration test summary, architecture notes, a data-flow diagram, and the order form with uptime and response times.

Hawcx

Security review

Prepared for acme.example

Requested by dana@acme.example

Under NDA

SOC 2 Type II reportSOC 2 report
Penetration test summaryPen test
Architecture notesArchitecture
Data-flow diagramData flow
Order form · SLA termsOrder form

Talk to our team

AI agent rollout, workforce SSO and your security review.

Book a demo

Request security docs ›