Claude and AWS are the two surfaces Opal Security chose to build against first, and that choice tells you more about the launch than the product name does. On 17 September 2026 the San Francisco access-governance company said Opal Zero, a system for granting and revoking permissions to enterprise AI agents, reaches general availability at the end of September. The headline feature is not a new console. It is a set of connectors into the places where agents are actually created.
Those places, for most large companies right now, are Anthropic’s Claude and AWS. Opal Zero ingests agent identities from Anthropic, AWS Bedrock, OpenAI, Cursor, Okta and Entra, then enforces its decisions inside gateways the customer already runs — Databricks Unity Gateway and AWS Bedrock AgentCore Gateway at launch. On the Claude and AWS side the deepest work is with Anthropic: it hooks the Claude Compliance API, admin controls for Claude Code, and Enterprise-Managed Authorization for MCP connectors.
This article walks through what the Claude and AWS work actually covers, how Gateway Sync differs from the proxy approach most agent-security vendors shipped first, what Opal’s own research says about the problem, what the design partners asked for, and where the gaps sit. If your organisation is already running coding agents against production systems, the mechanics below matter more than the category label — and they pair with the questions covered on our trust and security page.
Table of contents
- What Opal Is Shipping at the End of September
- Inside the Claude and AWS Integrations
- How Gateway Sync Differs From the Proxy Approach
- The Numbers Behind the Claude and AWS Push
- Who Built It: The Design Partners and What They Asked For
- Pricing, Availability and the Commercial Terms
- What the Claude and AWS Integrations Change in Practice
- The Gaps Worth Watching
- How to Evaluate This Before the End of September
- References
What Opal Is Shipping at the End of September
Opal Zero is a distinct product, not a mode inside the existing workforce governance platform, and its release date is the last week of September 2026.
The problem Claude and AWS agents create
Agents get credentials the way service accounts always did: someone provisions a token, the token never expires, and nobody records why it exists. Mrityunjay Gautam, Chief Information Security Officer at Instacart, put the consequence bluntly in Opal’s launch materials: “Long standing credentials for AI agents are basically full compromise with a delay timer.”
The three-part definition
Opal defines least privilege for agents as three things together: grants that expire, an owner for every agent, and a decision made at the point of access rather than at provisioning time. Most tooling delivers the first without the second or third, which is why standing privilege keeps accumulating across Claude and AWS estates alike.
Why Claude and AWS came first
Agent identities are not created in a vacuum. They are created inside a model provider’s console or an inference platform’s control plane. Claude and AWS cover the bulk of enterprise agent creation today, so a governance layer that cannot read from them is governing a partial picture.
What general availability includes
At GA the product ships with agent inventory and ownership mapping, a Risk Center, a reasoning model called Paladin that decides requests in real time, Policy Insights scoring, and Gateway Sync for enforcement. The Claude and AWS connectors are part of the base product rather than a paid add-on.
| Component | What it does | Where it touches Claude and AWS |
|---|---|---|
| Inventory and ownership | Maps every agent to a named owner and a documented purpose | Ingests from Anthropic and AWS Bedrock |
| Risk Center | Flags unowned agents, dormant identities, standing privilege, over-scoped access | Scores agents from both providers in one view |
| Paladin | Decides each request against policy and organisational context, recording its rationale | Applies to Claude Code and Bedrock agent requests alike |
| Policy Insights | Scores policies on hygiene, approval efficiency and provisioning speed | Provider-agnostic |
| Gateway Sync | Writes scoped permissions into the gateway already in the path | AWS Bedrock AgentCore Gateway, Databricks Unity Gateway |
| Authorisation hooks | Brings model-provider controls into the same access graph | Claude Compliance API, Enterprise-Managed Authorization for MCP |
Inside the Claude and AWS Integrations
The connector work splits cleanly along provider lines, and the two halves do different jobs.
The Claude Compliance API
Of the two halves of the Claude and AWS work, this is the reporting half. Anthropic’s Compliance API exposes organisational activity — who used what, through which workspace, under which key. Opal reads it so that Claude usage lands in the same access graph as a database grant or a cloud role, rather than in a separate vendor dashboard that nobody reviews.
Admin controls for Claude Code
Claude Code is the busiest of the Claude and AWS surfaces. It is the surface where an agent stops being a chat window and starts touching repositories, build systems and infrastructure. Opal Zero wires into its admin controls so an organisation can express what a coding agent may reach as policy rather than as a per-developer setting.
Enterprise-Managed Authorization for MCP connectors
Model Context Protocol connectors are how an agent gains a tool. Enterprise-Managed Authorization lets a security team, not an individual user, decide which connectors an agent may use. Opal hooks this so connector grants inherit the same expiry and ownership rules as every other grant in the Claude and AWS inventory.
AWS Bedrock as an identity source
On the AWS side, Bedrock is treated as a place agents are born. Opal ingests those identities and demands the same two facts it demands of a human account: who owns this, and what is it for. The Claude and AWS sources are normalised into one inventory rather than kept in provider-shaped silos.
AWS AgentCore Gateway as an enforcement point
AgentCore Gateway is where Opal writes the outcome of a decision. Rather than standing in the request path itself, Opal narrows the permissions the gateway already holds. That distinction is the architectural argument of the whole launch, and it applies identically on the Claude and AWS paths.
How Gateway Sync Differs From the Proxy Approach
The first generation of agent-governance tools did one of two things, and Opal is positioning Opal Zero against both.
What the first generation did
Some products stopped at inventory and discovery: a list of agents, a risk score, and no ability to act. Others inserted a proxy of their own into the request path and, in practice, issued a permanent grant through it. Neither delivers expiring, scoped access, and neither reads cleanly from both Claude and AWS.
The Opal argument
Opal’s claim is that the enforcement point already exists. If a company runs AgentCore Gateway or Unity Gateway, the gateway is already brokering tool calls. Adding a second broker adds latency, a failure domain and another set of credentials to protect — three costs the Claude and AWS integrations avoid by design.
What Gateway Sync actually writes
Gateway Sync translates a Paladin decision into carefully scoped permissions inside that existing gateway. The grant carries an expiry, whether it originated on the Claude and AWS path or elsewhere. When it lapses, the permission is removed rather than left dormant, which is how standing privilege normally accrues.
Why this matters for Claude and AWS shops
An organisation running Claude Code against AWS infrastructure typically has both halves already: model-side controls from Anthropic, and gateway-side controls from AWS. The Claude and AWS integrations are meant to make those two halves answer to one policy instead of two consoles.
The trade-off
Depending on an existing gateway means the enforcement story is only as good as the gateway coverage. An agent that calls a tool outside AgentCore or Unity is outside the enforcement path, even though it remains inside the Claude and AWS inventory.
| Approach | Sits in the request path | Typical grant | Main limitation |
|---|---|---|---|
| Inventory-only tooling | No | None — it cannot grant | Visibility without control |
| Vendor proxy | Yes, a new one | Permanent | New latency and failure domain |
| Opal Gateway Sync | No — reuses the existing gateway | Scoped and expiring | Limited to covered gateways |
| Manual ticketing | No | Permanent | Too slow for agent request rates |
The Numbers Behind the Claude and AWS Push
Opal Labs, the company’s research arm, published the figures the launch leans on, and they describe an accounting failure rather than an exotic attack.
Agents nobody can account for
More than 96 percent of non-human identities have no recorded purpose. That is not a claim about malicious agents; it is a claim that the organisation cannot say why the identity exists, which makes every later decision about it a guess, whether the identity came from Claude and AWS or from an older service account.
Access nobody has reviewed
Only 10 percent of that access has been reviewed in the past year. Non-human and agent identities already outnumber people at many companies, and the roughly 100-hour review cycle teams still run cannot cover the gap.
The earlier workforce findings that framed the Claude and AWS work
Opal’s March 2026 research found 48.6 percent of employees hold at least one entitlement unused for three months or more, and 80 percent of resources carry at least one stale assignment. Auto-granted access was 50 percent more likely to go unused than access a human reviewed.
Why the ratio is the story
If 96 percent of non-human identities lack a purpose and only 10 percent have been reviewed, the unreviewed-and-unexplained population is the overwhelming majority. That is the population the Claude and AWS connectors are meant to bring into view first, because that is where agents are being minted fastest.
Who Built It: The Design Partners and What They Asked For
Four companies worked with Opal on the product, and their quoted concerns map neatly onto the feature list.
Faire on speed
Mallory Rudolph, IT IAM Engineer at Faire, framed the timing problem: “Agent adoption moves faster than governance usually does.” That is the argument for deciding at the point of access rather than waiting for a review cycle, and it is why the Claude and AWS connectors read continuously rather than on a schedule.
Databricks on scale
Jack Zaldivar Jr., Staff Systems Engineer at Databricks, described the growth curve: “Agent identities are multiplying fast, and we want our controls to scale with that curve.” Databricks is both a design partner and the vendor behind Unity Gateway, which sits beside the Claude and AWS targets as the second launch enforcement point.
Superhuman on identity class
Den Potapenko, Head of Corporate IT and Security at Superhuman, made the categorical point: “AI agents are quickly becoming first-class identities across the AI platforms enterprises rely on.” First-class identity is the reason the Claude and AWS sources are normalised into the same inventory as staff accounts.
Elastic on continuity
Jean-Sebastien Caron, Senior Manager InfoSec Security Architecture at Elastic, was the most measured: “We use Opal for workforce access today, so we’re interested in how Opal Zero could support access governance.” That is a statement of interest, not a deployment, and it is worth reading it as written.
What the partner list signals about the Claude and AWS bet
Faire, Databricks, Elastic and Superhuman are all mid-to-large software organisations running heavy internal tooling. None is a regulated bank or a government department, which shapes how far the launch evidence stretches.
Pricing, Availability and the Commercial Terms
Opal published a specific number, which is unusual for an enterprise security launch and makes the offer easy to evaluate.
The launch price
Opal Zero is offered at 30,000 US dollars for 12 months, with that offer available through 30 December 2026. General availability is the end of September 2026.
What the number implies
A flat annual figure rather than per-agent pricing suits a market where nobody can yet predict agent counts. It also sidesteps the awkward incentive of charging more as an organisation’s Claude and AWS agent sprawl gets worse.
The company behind it
Opal Security raised 23 million dollars in June 2026 and is backed by Greylock Partners, Battery Ventures, Box Group, SVCI and Cambium Capital. Howard Ting became chief executive in December 2025, arriving from Cyberhaven after executive roles at Redis, Nutanix and Palo Alto Networks.
The existing customer base
Opal’s workforce product is already deployed at Cloudflare, Databricks, Elastic, Figma, Grammarly, Scale AI and Verily. Published figures include an 88 percent reduction in standing access at Chronosphere and 86,000 just-in-time access requests handled at Databricks.
| Detail | Stated figure |
|---|---|
| General availability | End of September 2026 |
| Launch price | 30,000 US dollars for 12 months |
| Offer deadline | 30 December 2026 |
| Most recent funding | 23 million dollars, June 2026 |
| Launch enforcement gateways | AWS Bedrock AgentCore, Databricks Unity |
| Launch identity sources | Anthropic, AWS Bedrock, OpenAI, Cursor, Okta, Entra |
What the Claude and AWS Integrations Change in Practice
For a team already running agents, the practical question is which of today’s manual steps disappear.
Provisioning stops being a ticket
Today a coding agent that needs a new data source usually waits for a human to approve a ticket. With a decision engine in the path, the common cases resolve immediately and only the unusual ones escalate, which is the same pattern Opal applies to workforce requests and now extends across Claude and AWS.
Ownership becomes mandatory
An agent without an owner cannot be reviewed, renewed or revoked responsibly. Forcing an owner at ingestion time is a small change with a large effect on every downstream process, and it applies equally across the Claude and AWS sources at ingestion.
Audit questions get answerable
Paladin records its rationale for each decision. That turns “why did this agent have access to that bucket” from an archaeology exercise into a lookup, which is the difference between passing and failing most access audits once Claude and AWS agents are in scope.
Cloud computing hygiene catches up with agents
The disciplines that matured around cloud computing — short-lived credentials, scoped roles, periodic review — never fully transferred to agent identities. The Claude and AWS work is an attempt to apply the same habits to a population that grew faster than the process around it, and it fits alongside a broader cloud adoption programme.
Sub-agents inherit the model
Opal governs agents, sub-agents and coding agents as distinct identity types. Sub-agents are where delegation quietly widens scope, so treating them as first-class rather than as an extension of their parent is the correct default on Claude and AWS alike.
The Gaps Worth Watching
The launch is specific about what it does, which makes the boundaries easy to identify.
Gateway coverage is the ceiling
Two gateways at launch is a narrow enforcement surface. Opal says Gateway Sync supports any MCP gateway, but the named, tested targets are AgentCore and Unity, and an untested gateway is a different proposition from a supported one, even for a Claude and AWS shop.
The quotes are about interest, not results
Four of the five customer quotes describe the problem or express interest. None reports a measured outcome from running the Claude and AWS integrations, because the product has not shipped yet. Treat them as design input rather than evidence.
The research is the vendor’s own
The 96 percent and 10 percent figures come from Opal Labs, the vendor’s research arm, and no methodology has been published alongside them. They are plausible and consistent with the March findings, but they are not independent, and they predate the Claude and AWS connectors.
Decision quality is unproven at scale
Paladin decides against policy and organisational context. Whether it escalates the right cases, and how it behaves when context is thin or contradictory, is the question that only production traffic across Claude and AWS answers.
Provider dependency cuts both ways
Building on the Claude Compliance API and Bedrock means the integration depth is bounded by what Anthropic and AWS expose. A change on either side of the Claude and AWS pairing is a change Opal must follow rather than control.
How to Evaluate This Before the End of September
If you are assessing the launch rather than reading about it, a few checks separate a real fit from a category match.
Count your Claude and AWS agents first
Pull the agent list from every model provider console you use and ask who owns each one. If you cannot answer for most of them, Opal’s 96 percent figure is describing your organisation, and the inventory alone has value before any enforcement.
Check which gateway you actually run
Enforcement lands in AgentCore or Unity. If your agents call tools through neither, the decision engine can still advise but the automatic narrowing of permissions does not apply, whatever the Claude and AWS inventory shows.
Test the escalation path
The value of deciding at the point of access depends entirely on how much gets decided automatically. Ask for the proportion of requests resolved without a human in a comparable deployment, and what happens when Paladin is uncertain.
Confirm the expiry behaviour
Expiring grants are the core promise. Verify what happens at expiry for an agent mid-task, because a permission that lapses during a long-running job is an availability problem as well as a security control.
Line it up against existing governance
Opal Zero is a separate product from Opal’s workforce platform. If you already govern staff access elsewhere, the integration between the two access graphs is the thing to test, not the agent features in isolation.