Opal Zero is Opal Security’s answer to a question most enterprises cannot currently answer: which AI agent has access to what, who decided that, and when does it stop. The company announced the product on 17 September 2026 and says it reaches general availability at the end of the month. The Opal Zero pitch is narrow and unusually concrete — make least privilege real for agents, rather than aspirational.
The reason the question is hard is arithmetic rather than philosophy. Opal Labs, the company’s research arm, reports that more than 96 percent of non-human identities have no recorded purpose, and that only 10 percent of their access has been reviewed in the past year. Non-human and agent identities already outnumber people at many organisations, while the review cycle teams run against them still takes roughly 100 hours. The population grew; the process did not.
What follows sets out what Opal Zero actually does, how its three-part definition of least privilege differs from what the first wave of agent-security products shipped, what Paladin and the Risk Center contribute, what the design partners said, what it costs, and which claims are still unproven. If your organisation has coding agents touching production, this is a control question before it is a procurement one — and it sits alongside the ground covered on our trust and security page.
Table of contents
- What Opal Zero Is
- The Numbers That Justify Opal Zero
- How Paladin Decides
- The Risk Center and What It Flags
- How Opal Zero Enforces Without a Proxy
- What the Design Partners Said
- Pricing, Backing and the Company Behind It
- Where Opal Zero Sits in a Crowded Category
- What Is Still Unproven About Opal Zero
- How to Pilot It Sensibly
- References
What Opal Zero Is
Opal Zero is a separate product from Opal’s existing workforce access platform, aimed specifically at agent identities rather than at staff accounts.
The definition it works from
Opal Zero defines least privilege for agents as three conditions holding at once: grants that expire, an owner for every agent, and a decision made at the moment of access rather than at provisioning time. Drop any one and the model collapses back into standing privilege.
Why the third condition is the hard one
Expiry and ownership are record-keeping. Deciding at the point of access means something has to evaluate a live request against policy fast enough not to break the agent’s task. That is the engineering problem Opal Zero is built around, and it is why the product needs a model rather than a rules table.
What it is not
Opal Zero is not a proxy, and the distinction is load-bearing rather than cosmetic. It does not insert itself into the request path and it does not issue its own long-lived credential. Instead it writes scoped, expiring permissions into a gateway the organisation already operates, then lets that gateway do the brokering it was already doing.
Where it gets its inventory
Opal Zero ingests agents from Okta, Entra, Anthropic, AWS Bedrock, OpenAI and Cursor, then maps each one to an owner and a documented purpose. Agents, sub-agents and coding agents are treated as distinct identity types rather than lumped together.
| Condition of least privilege | What most tooling does today | What Opal Zero claims to do |
|---|---|---|
| Grants that expire | Issues a permanent token | Writes a time-bound permission that lapses |
| An owner for every agent | Owner field optional or blank | Owner required at ingestion |
| A decision at the point of access | Decision made once, at provisioning | Paladin evaluates each request live |
| Documented purpose | Absent for 96 percent of identities | Required alongside the owner |
| Enforcement point | A new vendor proxy | The gateway already in the path |
The Numbers That Justify Opal Zero
The case for the product rests on research Opal published rather than on a named breach, and the figures describe an accounting problem.
Agents with no stated purpose
More than 96 percent of non-human identities have no recorded purpose. This is not a claim that those identities are malicious. It is a claim that the organisation cannot explain why they exist, which makes every subsequent decision about them a guess dressed as a policy.
Access nobody has looked at
Only 10 percent of that access has been reviewed in the past year. Put beside the 96 percent figure, the overwhelming majority of non-human access is both unexplained and unexamined, which is the population Opal Zero is designed to surface before anything else happens.
The review cycle that cannot keep up
Teams still run a review cycle measured at roughly 100 hours. When the identity population is growing faster than headcount, a fixed-cost manual review is guaranteed to fall behind, and the shortfall compounds every quarter.
The workforce findings underneath
Opal’s March 2026 research found 48.6 percent of employees hold at least one entitlement unused for three months or more, and 80 percent of resources carry at least one stale assignment. Auto-granted access was 50 percent more likely to go unused than access a human had reviewed — a direct argument against provisioning without a decision.
The scale claim
That earlier research also estimated organisations could face up to 900,000 manual access reviews a year. Opal Zero’s pitch is that agent growth pushes an already unworkable number further out of reach.
How Paladin Decides
Paladin is the reasoning model inside Opal Zero, and it is the component that makes the point-of-access condition possible.
What it evaluates against
Paladin assesses each request against the security team’s written policy and the organisation’s context — who owns the agent, what it is for, what it has touched before. The context half is what separates it from a static rule engine.
What it records
Every decision carries a documented rationale. That matters less for the approval and a great deal for the audit: the reason an agent held a permission becomes a retrievable record rather than an exercise in reconstruction.
What it escalates
The design intent is that Paladin approves what is clearly safe, escalates only what needs a human, and revokes access the moment it is no longer needed. The proportion it handles alone is the number that determines whether Opal Zero saves work or merely relocates it.
Where Policy Insights fits
Alongside Paladin, Policy Insights scores an organisation’s policies on hygiene, approval efficiency and how quickly access is provisioned. It is a feedback loop on the rules themselves rather than on individual requests.
The honest uncertainty
Paladin has not run at scale in customer production, because Opal Zero has not shipped. How it behaves when context is thin, stale or self-contradictory is the open question, and no launch material answers it.
The Risk Center and What It Flags
Before anything is decided, Opal Zero has to describe the estate, and the Risk Center is where that description surfaces.
Unowned agents
An agent with no owner cannot be renewed or revoked by anyone in particular. Surfacing these first is the cheapest win available, and for most organisations the list will be long.
Dormant identities
Agents that were created for a project, used briefly and never retired. They carry live credentials against systems nobody is watching, which is the classic quiet risk in any identity estate.
Standing privileges
Permissions that persist between uses. These are what expiry is meant to eliminate, and the Risk Center’s job is to show how much of the estate still depends on them.
Over-scoped access
Agents holding broader permissions than their task requires — usually because the scope was set once, generously, to avoid a second ticket. Over-scoping is the failure mode that turns a minor compromise into a major one, because the blast radius was decided months before the incident.
| Risk Center flag | Why it accumulates | What Opal Zero does about it |
|---|---|---|
| Unowned agent | Owner field never required at creation | Demands an owner at ingestion |
| Dormant identity | Project ended, credential did not | Surfaces it for revocation |
| Standing privilege | Permanent grant avoids repeat tickets | Replaces it with expiring grants |
| Over-scoped access | Scope set generously, once | Narrows permissions per request |
| Undocumented purpose | Nobody recorded the reason | Requires a documented purpose |
How Opal Zero Enforces Without a Proxy
Enforcement is where the architecture diverges most sharply from what came before it.
The first generation’s two shapes
Early agent-governance products either stopped at inventory and discovery — a list and a risk score, with no ability to act — or inserted a proxy of their own into the request path and, in practice, issued a permanent grant through it.
What Gateway Sync does instead
Gateway Sync translates a decision into carefully scoped permissions inside the gateway the organisation already runs. Databricks Unity Gateway and AWS Bedrock AgentCore Gateway are the supported targets at launch, and Opal says any MCP gateway is in scope.
Why avoiding a proxy matters
A new broker in the request path is new latency, a new failure domain and another credential store to defend. Removing that from the design is the strongest technical argument Opal Zero makes, and it is the one a security architect can evaluate without trusting a single vendor claim.
What it costs you
The enforcement surface is bounded by gateway coverage. An agent that reaches a tool without passing through a supported gateway stays visible in the inventory but sits outside the enforcement path, which is a real limit rather than a rounding error.
The model-provider hooks
Opal Zero also wires into the Claude Compliance API, admin controls for Claude Code and Enterprise-Managed Authorization for MCP connectors, plus Okta Cross App Access, so provider-side controls land in the same access graph.
What the Design Partners Said
Four companies shaped the product, and the quotes Opal published are about the problem rather than about results.
Instacart on standing credentials
Mrityunjay Gautam, Chief Information Security Officer at Instacart, gave the launch its sharpest line: “Long standing credentials for AI agents are basically full compromise with a delay timer.” That is the case for expiry stated as plainly as it can be.
Faire on pace
Mallory Rudolph, IT IAM Engineer at Faire, described the timing mismatch: “Agent adoption moves faster than governance usually does.” Faire is a named design partner on Opal Zero.
Databricks on the growth curve
Jack Zaldivar Jr., Staff Systems Engineer at Databricks, framed it as a scaling problem: “Agent identities are multiplying fast, and we want our controls to scale with that curve.”
Superhuman on identity class
Den Potapenko, Head of Corporate IT and Security at Superhuman, said agents “are quickly becoming first-class identities across the AI platforms enterprises rely on” — the premise the whole product rests on.
Elastic on interest rather than adoption
Jean-Sebastien Caron, Senior Manager InfoSec Security Architecture at Elastic, was careful: “We use Opal for workforce access today, so we’re interested in how Opal Zero could support access governance.” That is interest, and it should be read as interest.
Pricing, Backing and the Company Behind It
Opal published a headline price, which makes the offer easier to assess than most enterprise security launches.
The launch offer
Opal Zero is priced at 30,000 US dollars for 12 months, with the offer open through 30 December 2026. General availability is the end of September 2026.
Why flat pricing fits
Nobody can forecast their agent count a year out. A flat annual figure avoids both an unpredictable bill and the perverse incentive of a vendor earning more as a customer’s sprawl worsens.
The company
Opal Security raised 23 million dollars in June 2026, backed by Greylock Partners, Battery Ventures, Box Group, SVCI and Cambium Capital. Howard Ting became chief executive in December 2025, arriving from Cyberhaven after executive roles at Redis, Nutanix and Palo Alto Networks.
The installed base
Opal’s workforce platform runs at Cloudflare, Databricks, Elastic, Figma, Grammarly, Scale AI and Verily. Published customer figures include an 88 percent reduction in standing access at Chronosphere, 86,000 just-in-time requests handled at Databricks, 150 or more applications under governance at Superhuman and 5,353 Okta entitlements governed at Mercari.
| Fact | Figure |
|---|---|
| General availability | End of September 2026 |
| Launch price | 30,000 US dollars for 12 months |
| Offer closes | 30 December 2026 |
| Funding, June 2026 | 23 million dollars |
| Design partners | Faire, Databricks, Elastic, Superhuman |
| Standing access cut at Chronosphere | 88 percent |
Where Opal Zero Sits in a Crowded Category
Agent security became a funded category in under a year, and the entrants divide by what they are willing to do to a live request.
The discovery vendors
The largest group ships inventory: find every agent, score it, chart the growth. This is genuinely useful as a first step and genuinely insufficient as a control, because nothing in the product can narrow a permission. Opal Zero includes discovery but does not stop there.
The proxy vendors
The second group intercepts traffic through a broker of its own. Interception gives real enforcement power, at the cost of a new component in the critical path — and in practice most of these deployments settle on a permanent grant through the proxy, which reintroduces exactly the standing privilege the category was meant to remove.
The identity incumbents
Established identity providers are extending workforce governance to non-human identities. Their advantage is that the access graph already exists; their difficulty is that agent requests arrive at a rate and granularity the workforce model was never shaped for.
Where Opal Zero positions itself
Opal Zero argues for a fourth shape: decide centrally, enforce in infrastructure the customer already trusts. Whether that is a durable architectural advantage or a temporary consequence of which gateways exist today is the question the next two years settle.
What would falsify the pitch
If auto-resolution rates land low, or if gateway coverage stays narrow, Opal Zero becomes an expensive inventory with an approval queue attached. Both outcomes are measurable within a single quarter of production use, which is unusually easy to test for a security product.
| Category shape | Can it narrow a live permission? | New component in the path? |
|---|---|---|
| Discovery and inventory | No | No |
| Vendor proxy | Yes, but usually a permanent grant | Yes |
| Identity incumbent extension | Partially, on a workforce cadence | No |
| Opal Zero | Yes, scoped and expiring | No — reuses the existing gateway |
What Is Still Unproven About Opal Zero
The launch is specific, which makes its limits easy to name.
No shipped outcomes yet
The product reaches general availability at the end of September. Every customer statement in the launch describes a problem or an intention, not a measured result from running Opal Zero.
The research is the vendor’s own
The 96 percent and 10 percent figures come from Opal Labs, and no methodology was published with them. They are consistent with the March findings, but they are not independent verification.
Gateway coverage is the real ceiling
“Any MCP gateway” is a broad claim; two named launch targets is a narrow tested surface. The distance between those two statements is where a proof of concept should concentrate.
Autonomy needs a measured baseline
Automatic approval only helps if it covers most requests. Without a published auto-resolution rate from a comparable deployment, the efficiency claim is a design goal rather than a benchmark.
Provider dependency
The depth of the model-provider hooks is bounded by what Anthropic, AWS, OpenAI and the rest expose. Opal follows those interfaces; it does not control them.
How to Pilot It Sensibly
If Opal Zero is on your shortlist, a short evaluation answers more than a long one.
Start with the inventory, not the enforcement
Run the ingestion and see how many agents come back without an owner. If your estate matches the 96 percent figure, the inventory has value on its own before any policy is written.
Pick one gateway and one team
A pilot scoped to a single gateway and a single engineering team produces a clean auto-resolution rate. A broad pilot produces an average that hides the cases you care about.
Test expiry against a long-running job
Expiring grants are the core promise and the obvious operational risk. Find out what happens when a permission lapses mid-task, because that is an availability question as much as a cybersecurity one.
Check the escalation queue
Measure what lands in front of a human and how long it waits. If the escalation queue simply replaces the old ticket queue, the governance burden has moved rather than shrunk.
Decide how it joins your existing access graph
Opal Zero governs agents; Opal’s other product governs people. If you run both, the join between the two graphs is the thing worth testing, and it is the part most likely to need work. A clear picture of the estate is also what makes ongoing managed IT services sustainable as agent counts rise.