Purpose-Built Tool
Powered by KeyFlux Core

REMIT

Agentic AI Controls

Safeguard Agentic AI in your IT Operations. Pipelines get scoped, time-limited credentials for exactly what they need, verified against a change ticket, and revoked the moment the job completes.

The Problem with Pipeline Access Today

CI/CD pipelines touch production infrastructure every day. The credentials they use were designed for humans sitting at terminals.

Standing Permissions

CI/CD pipelines and agents accumulate access over time. Service accounts granted once are rarely scoped or revoked, creating expanding attack surfaces.

Long-Lived Credentials

Static API keys and service account tokens persist indefinitely. A leaked key from months ago still has full access today.

Coarse-Grained Access

Cluster-admin or broad namespace access when a pipeline only needs to patch a single deployment in a single namespace for a single run.

No Change Traceability

When a deployment fails at 2am, there is no verifiable link between the infrastructure change, the pipeline run, and the change ticket that authorized it.

How It Works

A six-stage pipeline from OIDC authentication to automatic credential revocation. Click any stage to expand.

Key Capabilities

Scoped Sessions

Every session is bound to a specific change, specific resources, and a 60-300s TTL. No standing access.

CI/CD Native

Built-in support for GitHub Actions OIDC and GitLab CI. Pipelines authenticate with their native identity tokens.

Kubernetes Scope Compilation

Glob patterns like k8s:namespace/resource/name:verb are compiled to Kubernetes RBAC rules at credential issuance time.

Fail-Closed Enforcement

Every operation is validated against the session scope in real time. Anything not explicitly allowed is denied.

Plugin Architecture

Swappable plugins for orchestrators, credential issuers, and target infrastructure probers.

Hash-Chained Audit Trail

Every session, credential issuance, operation, and closure is logged in an immutable, hash-chained audit trail.

Before & After

Static service accounts were designed for a world without CI/CD pipelines deploying to production hundreds of times a day.

Static Credentials

The status quo

Identity
Shared service account
Scope
Full namespace or cluster
TTL
Indefinite
Change Link
Comment in commit message
Credentials
Static kubeconfig
Audit
kubectl logs
Enforcement
Trust the pipeline

REMIT

Just-in-time, scoped, verified

Identity
Verified pipeline + actor
Scope
Single resource, single verb
TTL
60-300 seconds
Change Link
Verified change ticket
Credentials
Dynamic Vault-issued, auto-revoked
Audit
Hash-chained, immutable trail
Enforcement
Fail-closed, real-time validation

Get Early Access

REMIT is in private preview. If your pipelines touch production infrastructure and you need authorization that matches, we want to talk.

Request Access