Launch HN: Alter (YC S25) – Access control for multi-user agents

Based on 7 sampled comments from this thread. Analyzed 2026-10-22.

The thread treated Alter less as another secret store than as an attempt to make agent delegation survivable in the messy real world: many users, many credentials, and agents that can be manipulated. Commenters liked the core premise that credentials should stay behind a proxy and that policy enforcement must happen outside the model, because prompt injection is not a failure mode anyone believes can be reliably trained away. The company’s distinction from conventional secret managers also landed: the difficult part is not storing a key, but binding the right end-user identity and permissions to an agent action. The hard questions were about whether this boundary is sufficiently granular. Several readers focused on context and long-term memory, arguing that a shared agent can carry privileged facts from one user into another user’s session or room even when API credentials are correctly scoped. The response that memory can be partitioned by user and agent reassured some, but the discussion kept pressing on shared rooms, derived tool artifacts, and downstream APIs that expose only a common service key. Security credibility was the other flashpoint: readers were sharply skeptical of trusting closed-source, apparently rapidly built authorization infrastructure, while the team pointed to penetration tests, a trust center, and ongoing SOC 2 work.

The central dispute is whether credential-level authorization and per-user memory partitioning actually secure shared, multi-user agents. Supporters argue that an external proxy holding the keys, combined with identity-bound credential grants and partitioned context, blocks both prompt-injection bypasses and cross-user memory exposure. Skeptics argue that shared rooms, transcripts, tool outputs, and downstream systems with shared API keys create information-flow and record-level authorization problems that a token proxy alone cannot settle.

• Praise: Keeping credentials exclusively in an enforcement proxy gives prompt-injected agents far less room to turn a compromised conversation into unrestricted API access.
• Praise: Per-user, per-agent memory partitioning directly targets the nastiest multi-tenant failure mode: a contractor inheriting sensitive context accumulated for an executive.
• Praise: The product tackles the operationally painful layer beyond secret storage: mapping each end user’s credentials and grants to an agent acting on their behalf.
• Praise: The team’s stated penetration testing and public security-material effort offer more concrete assurance than asking customers to accept an agent-security product on branding alone.
• Concern: Shared-room transcripts can become an accidental privilege boundary, letting context read during a privileged exchange persist into every later interaction.
• Concern: Tagging or partitioning memories does not automatically contain derived artifacts such as tool results, file handles, and other state created under broader access.
• Concern: A downstream service with one shared API key still needs record-level ownership checks somewhere; credential mapping cannot conjure isolation the target API does not expose.
• Concern: Readers are wary of placing authorization for autonomous agents in a closed product that appears lightly engineered, especially before its compliance program is complete.