# Opal Security

> Opal is an AI-native access governance platform and the access control plane for every identity: employees, contractors, service accounts, non-human identities (NHIs), and AI agents. It decides every access request against your policy and enforces the decision in the identity and gateway infrastructure you already run.

Opal governs access across SaaS, cloud, databases, and on-premises infrastructure. It does not replace your identity provider. Opal sits on top of the one already in place (Okta, Entra ID, and others) and adds the decision and enforcement layer that traditional identity governance tools handle on a quarterly review cycle. It is built for engineer-led, cloud-native enterprises where security and engineering teams own access.

The platform has three parts:

- See: Discovery maps every identity, entitlement, and access path. OpalQuery lets teams ask who has access to what, and why, in plain English, including over-provisioned access, separation-of-duties conflicts, and privilege escalation paths.
- Encode: Access policy is written as versioned, reusable logic with OpalScript, either in code or described in plain language and generated by AI.
- Enforce: Paladin, Opal's AI decision engine, evaluates every request, approves what is safe, escalates only what needs a human with a stated reason, and revokes access when it is no longer needed. Grants are time-bound by default and produce audit evidence as a byproduct.

Opal Zero extends the platform to AI agents. Each agent is inventoried, attached to an owner and a declared purpose, and limited to the access its owner holds. Paladin decides each agent request at the moment it is made, and Gateway Sync writes the decision into the MCP gateway already in use as scoped, time-bound policy, with no second proxy in the path. Opal Labs research found that more than 96% of non-human identities have no recorded purpose, and only 10% of their access has been reviewed in the past year.

Customer results include an 88% reduction in standing access at Chronosphere, 86,000 time-bound access requests approved at Databricks, 150+ apps under governance at Superhuman, 5,353 Okta entitlements governed at Mercari, a 78% reduction in privileged access at Palo Alto Networks, 1,500+ developers on just-in-time access at Sophos, and access requests cut from 3 days to 5 minutes at Valon. Opal works with 100+ enterprise teams, including Databricks, Elastic, Grammarly, Cloudflare, Coreweave, Notion, Superhuman, Runway, Mercari, and Blend.

Opal Security is a Series B company that has raised $59 million from Greylock Partners, Battery Ventures, Box Group, SVCI, and Cambium Capital. It was named to Notable Capital's Rising in Cyber 2026 list. Opal is SOC 2 Type 2 certified and can be deployed in Opal's cloud, a customer's own VM, or Kubernetes, with US or EU hosting.

## Platform

- [Platform overview](https://www.opal.dev/platform): How Opal discovers access, encodes policy, and enforces decisions across the identity stack for humans, NHIs, and AI agents.
- [Opal Zero](https://www.opal.dev/zero): Access governance for AI agents. Inventory, Risk Center, Policy Insights, Paladin decisioning, and MCP gateway enforcement. Priced per human identity with no cap on agents. Launch offer: $30,000 for 12 months, available through December 30, 2026, for organizations under 3,000 employees.
- [Paladin](https://www.opal.dev/platform#paladin): The AI decision engine. Reads each access request for purpose, scope, and owner coverage, approves when confident, escalates with a stated reason when not, and shows its reasoning with a full audit trail.
- [Integrations](https://docs.opal.dev/integrations/): Connected systems across identity providers (Okta, Entra ID, Active Directory, Google Workspace), cloud (AWS, GCP, Azure), data (Snowflake, Databricks), developer tools (GitHub, GitLab, Terraform), SaaS (Salesforce, Slack, Jira, ServiceNow, Workday), and AI platforms (Anthropic, OpenAI, Cursor, Devin).
- [Opal Query](https://docs.opal.dev/docs/opal-query): Query access in plain English, including which identities can reach which resources and why.

## Opal Zero launch

- [Opal Zero launch announcement](https://www.opal.dev/media-press/opal-zero-launch): Launched September 17, 2026, with general availability at the end of September 2026. Built with design partners Faire, Databricks, Elastic, and Superhuman.
- Agent inventory sources at launch: Okta, Entra ID, Anthropic, AWS Bedrock AgentCore, OpenAI, and Cursor.
- Enforcement at launch: works with any MCP gateway, including Databricks Unity Gateway and AWS AgentCore Gateway.
- Ecosystem integrations at launch: Claude (Compliance API, Claude Code admin controls, and Enterprise-Managed Authorization for MCP connectors), Databricks Unity Gateway, and Okta Cross App Access (XAA).
- [Q&A with CPO Sameer Mehta](https://www.opal.dev/blog/introducing-opal-zero-qa-sameer-mehta): The thinking behind Opal Zero.

## Guides

- [Identity governance and administration (IGA)](https://www.opal.dev/identity-governance-administration): What IGA is, why legacy programs fail cloud-native teams, and how modern AI-native IGA maps to classic capabilities.
- [Access governance](https://www.opal.dev/access-governance): Continuous least-privilege access governance for engineer-led enterprises: decide, enforce, and prove every access grant.
- [AI-native IGA](https://www.opal.dev/ai-native-iga): Paladin, Opal Zero, and continuous enforcement for humans, NHIs, and AI agents.
- [Compare Opal](https://www.opal.dev/compare): How Opal compares to traditional IGA and NHI security tools.
- [Opal vs SailPoint](https://www.opal.dev/compare/opal-vs-sailpoint): Comparison of modern access governance and traditional enterprise IGA.
- [Opal vs Oasis Security](https://www.opal.dev/compare/opal-vs-oasis): Comparison of access governance and NHI / agentic access management (Oasis, now Cyera Identity).
- [Opal vs Clutch Security](https://www.opal.dev/compare/opal-vs-clutch): Comparison of access governance and NHI, secrets, and agent identity security.

## Use cases

- **[Just-in-time access](https://www.opal.dev/platform)**: Time-bound grants that replace standing entitlements across SaaS, cloud, and infrastructure.
- **[AI-guided access reviews](https://www.opal.dev/platform#paladin)**: Surface the riskiest access with explainable recommendations, and automate routine decisions so reviewers focus on judgment calls.
- **[Programmable governance](https://www.opal.dev/platform)**: Access policy written as versioned, testable code instead of console configuration.
- **[Security for AI agents](https://www.opal.dev/zero)** ([AI-native IGA](https://www.opal.dev/ai-native-iga)): Governing agent identities, including ownership, purpose, scoped access, and revocation.
- **[Access intelligence](https://docs.opal.dev/docs/opal-query)**: Discovery and investigation across the full access graph.
- **Compliance**: Audit evidence for SOC 2 and other compliance audits, produced as a byproduct of logged, time-bound access decisions.

## Customers

- [Customers](https://www.opal.dev/customers): Named deployments and outcomes across security engineering, identity and access, fintech, and compliance teams.
- [Databricks](https://www.opal.dev/customers/databricks): JIT, access reviews, and time-bound access, with 86,000 time-bound access requests approved.
- [Chronosphere](https://www.opal.dev/customers/chronosphere): Protecting sensitive customer data on GCP, with a 78% reduction in time to approve or deny access requests.
- [Mercari](https://www.opal.dev/customers/mercari): Zero-touch access to production systems, with 5,353 Okta entitlements governed.
- [Blend](https://www.opal.dev/customers/blend): Identity security with deterministic logic across 5,000 employees.
- [Valon](https://www.opal.dev/customers/valon): Timed access to sensitive permissions.
- [CoinList](https://www.opal.dev/customers/coinlist): Automated access management.

## Company

- [About](https://www.opal.dev/about): Company background, funding, and leadership, including CEO Howard Ting, CTO Alex Pien, and CPO Sameer Mehta.
- [Blog](https://www.opal.dev/blog): Product launches, technical deep dives, and market analysis.
- [Trust Center](https://www.opal.dev/legal/trust-center): Security posture, certifications, and subprocessors.
- [Media and press](https://www.opal.dev/resource-center#media-press): Press coverage and company announcements.

## Documentation

- [Documentation](https://docs.opal.dev): Technical reference for deployment, integrations, policy authoring, and APIs.

## Optional

- [Careers](https://www.opal.dev/careers): Open roles.
- [Events](https://www.opal.dev/resource-center#events): Conferences, webinars, and in-person events.
- [Brand resources](https://www.opal.dev/brand-resources): Logos, wordmarks, and usage guidelines.
- [Terms of service](https://www.opal.dev/legal/terms-of-service)
- [Privacy policy](https://www.opal.dev/legal/privacy-policy)