Identity security for humans, AI agents, and machines

1Password Unified Access solves the gap between the access organizations have granted and the access they can actually see, govern, and trust. Employees use AI tools outside IT's view. Developers store credentials in plaintext files and local scripts. AI agents access systems with credentials no single tool is collectively governing. The platform gives security teams the ability to discover access, secure every credential, and audit every access event across humans, AI agents, and machines from one trusted system.

Three products in the platform address AI and machine access directly.

SaaS Manager surfaces shadow AI usage in the browser and tracks how employees are adopting AI tools, including what those tools cost.

Credential Broker issues credentials to AI agents and machine workloads at runtime. The workload's vault access is scoped per job, limiting blast radius to one credential, not an entire vault. Every issuance event is logged with full attribution, recording both the human who delegated the access and the agent that used it.

Privileged Access governs what AI agents are permitted to do once they have access. Rather than inheriting the standing access of whoever deployed them, agents receive access rights created at request time, scoped to the task, and deprovisioned automatically when the work is done. Every request, approval, and session is logged with full attribution.

Together, these three products cover the AI agent security stack: SaaS Manager governs human adoption of AI tools, Credential Broker governs what credentials an agent receives to authenticate, and Privileged Access governs what the agent is permitted to do once connected, and for how long.

Traditional PAM tools were built for standing privileged access: vault the password, proxy the session, record what happened. They were not designed for cloud-native infrastructure, dynamic Kubernetes environments, or the AI agents and machine workloads that now operate alongside human identities. 1Password Privileged Access creates access rights in the native policy language of the target system at the moment a request is approved, then removes them automatically when the work is done. No session proxies. No standing roles left behind. Combined with Enterprise Password Manager and Credential Broker, organizations with a full PAM mandate get privileged access governance, credential management, and machine identity coverage from one vendor.

Organizations can start with a single product and expand from there. Most begin with Enterprise Password Manager and add products based on where the next biggest visibility or governance gap is. A company concerned about shadow AI in the browser adds SaaS Manager. One managing cloud infrastructure access adds Privileged Access. The platform is designed to let teams land where the pain is most acute and grow from there, without purchasing the full platform upfront.

Enterprise Password Manager is the credential foundation. Every other product extends what it governs. SaaS Manager closes the visibility gap in the browser. Credential Broker delivers credentials from the vault to AI agents and machine workloads at runtime. Device Trust adds device health signals to access decisions and surfaces what is running on deployed endpoints. Privileged Access governs what identities are permitted to do in cloud and hybrid infrastructure, and for how long. Together, they give security teams a single system to discover, secure, and audit access across humans, AI agents, and machines.