Saviynt has launched Zuma, its new AI Agent Identity Security Platform, alongside an announcement that the company has passed $300 million in ARR.
The claimed point of difference is where the access decision happens. Rather than resolving to a standing entitlement, Zuma makes the decision at runtime, based on the specific action the agent is attempting.
Saviynt's own illustration: an agent may have general access to Salesforce and still be blocked from a particular action, if the context, permissions or risk attached to that action are wrong.
Why runtime is the right altitude for agents
Traditional entitlement models assume the principal is reasonably predictable. A person granted access to a CRM will do CRM-shaped things with it, at human speed, during a working week. The entitlement is a decent proxy for the behaviour.
Agents break that proxy. The same credential can be pointed at any capability the system exposes, thousands of times an hour, driven by an instruction that may itself have been injected by someone else. Granting an agent "access to Salesforce" describes almost nothing about what it will actually do.
For a human, the entitlement is a fair prediction of the behaviour. For an agent, it is barely a hint.
Moving the decision to the action is therefore the logically correct response, and it is not only Saviynt reaching that conclusion. The new MCP specification covered elsewhere in this issue exposes the method and tool name in HTTP headers precisely so a control point can evaluate individual tool calls. Different layer, same instinct: the unit of authorization for agents is the action, not the account.
The questions to ask a vendor pitching this
Runtime authorization is genuinely the right model. It is also considerably harder to operate than it is to demonstrate, so it is worth pressing on the details.
Where does the decision point actually sit? In front of the application, inside it, or at the agent framework. That determines what it can see and what it can be bypassed by.
What is the latency budget? An agent making thousands of calls will feel a policy evaluation on every one of them, and teams under delivery pressure route around slow controls.
Who writes the policies, and how many are there? Action-level policy is expressive, which is another way of saying there is a lot of it. Ask what the model looks like at a thousand agents rather than at ten.
What happens when the decision point is unavailable? Fail open and it is decoration. Fail closed and it is now a production dependency for every agent you run.
What does it do with an agent acting for a user? Runtime action control is most valuable when it can distinguish the agent's own authority from the delegated authority of the person who asked.
Saviynt is not alone here and will not be for long. The useful thing about the launch is less the product than the confirmation that the category has settled on runtime, action-level decisions as the direction. That is a shift identity teams should be planning for regardless of whose logo ends up on it.