Opal 0 gives AI agents zero standing permissions
Opal launches Opal 0, which gives agents no standing permissions and instead grants just-in-time scoped access per task, with approval decisions automated.
Opal 0 gives AI agents zero standing permissions, on purpose. Every team I talk to that is shipping agents hits the same wall, and access is the part nobody plans for. Identity tooling grew up around a few hundred humans whose access sits untouched until the next review. An agent asks for access all day long, and every request is a small decision about what it should be allowed to touch right now. Opal frames the shift as a million micro-decisions versus a hundred human identities, and that framing lines up with what those teams describe. Broad permissions on a human get caught at review time, while the same permissions on an agent move at machine speed, so one bad prompt or one leaked key can burn through everything that access was ever allowed to touch. Opal's launch line is three zeros, zero standing permissions, zero human toil, zero friction. The mechanism, per Opal's launch post, is just-in-time scoped permissions granted per task and pulled back when the task ends. The approval judgment itself is automated, so security stops clicking through requests all day. Opal already reports the human version working, citing Databricks at 86,000+ time-bound access requests and Chronosphere with standing access down 88%. Their argument is that agents follow the same pattern, only much faster. The judgment layer is the part a security team will actually grade, and the part I'd watch. Every agent request is a decision, and whoever automates that decision well enough for a CISO to trust it in production decides how far agents get to go. My read is that over the next year the ceiling on agent deployment moves at whatever speed governance learns to say yes safely.
This post quotes another post: x.com/i/web/status/2100607288000324065