FAQ

No. Arcane federates with your existing identity provider via OIDC or SAML — Okta, Entra, Google Workspace, Auth0, or anything else that speaks the standard — and adds an authorization layer on top. Users still log in where they always have.

No. Arcane issues short-lived credentials at request time and signs every decision. It does not store long-lived passwords or static keys. Where downstream services require a vendor token, Arcane brokers a short-lived exchange at request time.

Two paths. The SDK wraps tool invocations inside your agent process. The transparent proxy sits in front of any HTTP service — MCP servers, internal APIs, third-party SaaS — and evaluates the same policy.

A structured, signed record per decision: timestamp, user, agent, workload, task, resource, matched rule, outcome. Chained for tamper-evidence. Exportable in formats your auditor accepts.

In your account. The control plane is VPC-native — policy evaluation, token mint, and audit emission stay inside your perimeter. No round-trip to a third party.

We're working directly with a small number of teams whose agents touch real data — internal or customer-facing. Request access to start a conversation.