Launch HN: Alter (YC S25) – Access control for multi-user agents

Alter is a new startup from Srikar and Kevan, and its pitch is simple: agents need their own access control layer. The company wants to sit between an agent and the external systems it touches, so a Slack user signing in with their own account doesn’t accidentally hand the agent a blank check through one shared API key.

That gap is easy to miss until you try to ship something real. User-level auth inside Slack doesn’t decide what the agent can do in a CRM, billing system, or anything else downstream. Alter’s answer is to act as a proxy, manage credentials per API request, and take the end user’s identity into account every time the agent acts.

The product also enforces fine-grained runtime policies and keeps compliance-grade audit logs. Alter says it supports hundreds of providers, all manually tested end to end, and that reliability is the core obsession. The company also says it is building in a way that lets developers keep control over how their agents are designed, with custom policies, delegation, user attribution, and audit logging as part of the stack.

The founders are framing this as a separate product category, not just another auth tool bolted onto an agent app. Srikar says the pain showed up firsthand at Goldman, where custom auth for multi-tenant agents was expensive to build. Kevan brings experience from a database startup and from selling into regulated environments, which is exactly where this problem gets nasty fast.

Alter says it already has real-world users: internal agents for its own team, startups building SRE, back-office, QuickBooks, and payroll agents, plus a defense contractor working on air-gapped agents for the Marine Corps. The business model is usage-based, with a free tier up to 10k requests and paid pricing beyond that. The company is also asking builders what they’ve had to roll themselves just to make multi-user agents safe.