Production Change Protection
Deploys, infrastructure and configuration changes, bound to the exact repository, commit and environment, with identity, approvals and separation of duties.
Products
One protection layer for consequential actions.
AtlaSent sits between a proposed consequential action and the system that carries it out. Enterprise products protect a business outcome, the operating layer runs that protection across the organization, and developer tools put the same checks in your own code.
Enterprise products
AI Action Protection
Agent tool calls that change real systems, with the agent’s identity, provenance and delegated authority kept separate, and a person in the loop where your rules require one.
The same runtime also protects privileged access, data release, finance actions and regulated actions.
Enterprise operating layer
What Enterprise adds.
Protection Portfolio
Every protected action in one place: what it protects, the path it runs on, the requirements it enforces and its current state.
Coverage
Each action and execution path is Complete, Partial, Unknown or Not configured. Unknown stays Unknown. It is never shown as protected.
Identity and administration
People, services and AI agents are resolved as distinct identities. Enterprise identity and member administration are confirmed for your environment in the agreement.
Organizational controls
Approvals, separation of duties and independent review are required where your rules say, and kept separate from who can administer the rules.
Findings and operations
Blockers, gaps and drift are surfaced with the exact repair, so owners can fix protection instead of reading a wall of green checks.
Evidence and proof
Every decision leaves a signed, hash-linked record you can verify offline. Execution and effects are recorded only when they are actually observed.
Support and implementation
Assisted implementation of your first protected action, and support commitments written into the agreement.
Not another IAM tool
Your identity tools decide who can get in. AtlaSent decides whether this exact action may happen now.
Keep your identity provider, SSO and access management. They establish who someone is and what they can reach. AtlaSent adds the step they were not built for: checking that the organization authorized this specific action, right before it runs.
Identity & access tools
Who you are, and what you can reach.
Who you are
Sign-in, SSO, MFA and directory groups establish identity.
Standing access
A role or credential grants access that holds until someone removes it.
Checked at sign-in
Access is decided when a session or token is issued.
Built for people
Pipelines and AI agents act through shared or stored credentials.
Access logs
Logs show who signed in and what they touched.
AtlaSent
Whether this exact action is authorized, now.
What you may do, now
Whether the organization authorized this exact deploy, grant, export or agent action.
One approved action
A permit covers one action. Change the commit, target or amount and it needs approval again.
Checked where it runs
The permit is verified at the point of execution, not only when the request was made.
People, software and AI agents
The same rules apply whoever acts, with the actor’s identity kept separate from its authority.
Evidence you can check
Every decision, yes or no, leaves a signed, hash-linked record verifiable offline without trusting us.
Keep your IdPIdentity is one input
One action, one permitNothing standing to revoke
Verified at executionNot just at request time
Evidence you ownCheck it offline
AtlaSent does not replace your identity provider. It uses identity as one input and adds the organization’s authority for the specific action.
Where it connects
At the point the action executes.
A step in your CI/CD pipeline (GitHub Actions today), the TypeScript and Python SDKs in your own code, the MCP server for AI agents, and the REST API. Other change platforms are scoped per engagement; a connected integration is not the same as an enforcing one.
Developer distribution
Open Source / Community tools, Developer Cloud and Team Cloud are self-service ways to build with AtlaSent. They are separate from Enterprise. See the developer path.
Platform contract
Intent → Authority → Policy → Evaluation → Permit → Verification → Execution → Evidence. Each product configures the action and the facts that matter; none forks the core lifecycle.
Control: the action runs only after an allow decision and a permit bound to that exact action is verified where it executes.
Evidence: a signed, hash-linked record of every decision that can be verified offline.
AtlaSent Enterprise
Protect the first action that matters.
Enterprise is custom annual pricing, scoped to the actions, systems and teams you need to protect.