# Enterprise identity for AI agents and people. Governed across teams. Signed in without passwords. > Govern AI agents with Cedar policy on each tool call, human approvals and signed receipts. Phishing-resistant passwordless login for staff and customers. Markdown version of . Last updated 2026-10-07. One policy for every team's agents, a signed receipt for every permitted action, and passwordless sign-in alongside the identity provider you already run. - Cedar policy on every tool call - Signed receipts for your auditors - Passwordless SAML SSO for Entra ID and Google Workspace - SOC 2 Type II ## The questions your auditors will ask. Answered on every receipt. Each permitted action leaves a signed receipt: which agent acted, for whom, under which policy, and who approved it. 1. **Who does this agent answer to?** 2. **What was it allowed to do?** 3. **Can we prove it?** Receipts are evidence, not a certification. ## Limits set once, per tier. Builders keep shipping. Security sets a cap for each trust tier. Platform teams connect agents through MCP, CrewAI or OpenShell, and every tool call is checked against the same policy. ### For security and risk teams - [Trust tiers: Cap what each agent may attempt, from read-only to privileged admin.](https://www.hawcx.com/ai-agents/authorization) - [One policy set: Checked on every tool call: allow, hold or deny.](https://www.hawcx.com/ai-agents/authorization) - [Human approval: Sensitive actions wait for a named person.](https://www.hawcx.com/ai-agents/approvals) - [Revocation: End an agent's authority from one place.](https://www.hawcx.com/ai-agents#govern) ### For platform and AI teams - MCP authentication: Authenticate MCP clients and authorize each tool call. - [CrewAI: Each tool call is authorized before it runs.](https://www.hawcx.com/news/hawcx-crewai-partnership) - [OpenShell: The sandbox bounds where an agent goes. Hawcx decides what it may do there.](https://www.hawcx.com/news/extending-openshell-with-hawcx-for-action-based-authorization-for-agents) - [Docs and SDKs: Reference code, quickstarts and API docs.](https://docs.hawcx.com) ## Your directory stays. Passwords go. Hawcx acts as a passwordless SAML identity provider federated with Microsoft Entra ID or Google Workspace, so employees unlock their apps with a biometric or device PIN. Your directory stays in place. ## Security, drawn plainly. Where each control lives. One reference sheet for your reviewers: what runs in your cloud, what Hawcx operates, and what never leaves the device. Reference deployment sheet SEC-01 for Acme and Hawcx, illustrative. Acme's five agents run in your cloud and call billing-tools (MCP), deploy-api and support-desk; a Hawcx check sits at the door of each service. Only a decision and a receipt cross to the Hawcx control plane, which holds Policy (Cedar), Approvals and Receipts. Employees sign in from their devices with device-bound keys, over SAML to Microsoft Entra ID or Google Workspace. The title block carries a SOC 2 Type II seal. Deployment options and data residency are agreed per contract. ### Integrate Passwordless SAML SSO for Microsoft Entra ID and Google Workspace. MCP, CrewAI and OpenShell for agents. Works alongside your identity provider. ### Support Onboarding and pilot support, a named technical contact, and uptime and response times written into your order form. ## Start with one workflow. Expand when the evidence is in. 1. **Scope**: Pick one agent workflow with real risk, such as refunds or deploys, or one app to move to passwordless sign-in. 2. **Pilot**: Enroll the agents, write the policy, route sensitive actions to approvers, and review the receipts. 3. **Security review**: Your reviewers get the SOC 2 report, architecture notes and a data-flow diagram. 4. **Expand**: Add agents and teams, and move employees to passwordless SSO through Entra ID or Google Workspace. ## Enterprise questions, answered. - [Security & trust](https://www.hawcx.com/security) - [Pricing](https://www.hawcx.com/pricing) - [Book a demo](https://calendly.com/team-hawcx?utm_source=hawcx.com&utm_medium=website&utm_campaign=enterprise&utm_content=enterprise) ### How does Hawcx work across many teams? Security sets trust tiers and one policy set. Each team connects its agents through MCP, CrewAI or OpenShell. Sensitive actions wait for a named person, every permitted action is signed, and any agent can be revoked from one place. ### Does Hawcx replace Okta, Microsoft Entra ID or Google Workspace? No. For AI agents, Hawcx adds per-action authorization, human approvals and signed receipts next to your identity provider. For workforce sign-in, Hawcx can act as a passwordless SAML identity provider federated with Microsoft Entra ID or Google Workspace, so your directory stays in place. ### What evidence can we give auditors about agent actions? Each permitted action produces a signed receipt, and sensitive actions can be held for a named person to approve or reject. Hawcx provides evidence. It does not certify compliance with any regulation. ### Can our security team review Hawcx? Yes. Request our security documentation, and we will share what applies to your review, including the SOC 2 Type II report under NDA. ### How is Hawcx deployed, and what support comes with an enterprise plan? Deployment and support terms are agreed per contract, including deployment options, data residency, uptime and response times. Book a demo to discuss your requirements. ### How is enterprise pricing structured? Passwordless authentication is priced per monthly active user. For AI agent pricing, book a demo. ### What do we need for procurement? MSA, DPA and security questionnaire support on request. ## Choose how to start. Self-serve, or a guided rollout. ### Start with passwordless Self-serve, phishing-resistant sign-in for your apps. ### Talk to our team AI agent rollout, workforce SSO and your security review.