Roadmap
Keymate's roadmap has four items: access reviews in Identity Governance, SCIM 2.0 provisioning, AI agents with their own identity and policies, and a managed service run by us. Everything else on Keymate's module pages is available today. None of the roadmap items has a published date.
How we mark what is not available yet
Anything not yet available appears on the site as "on the roadmap", or "Not yet" in comparison tables, and is listed here. When it becomes available, it moves to its module page.
Where each part of Keymate stands today
Each row shows what is available today and, where there is one, what comes next.
| Theme | Available today | Next |
|---|---|---|
| Identity | Users, organizations and federation; account changes through Keymate's API | SCIM 2.0 provisioning |
| Authentication | Single sign-on, multi-factor authentication with step-up, organization-aware tokens | |
| Authorization | A decision on every request, six policy models, five enforcement points | |
| Authorization Governance | Optional approval, simulation, versions, evidence records, time-bound access | |
| Identity Governance | Joiner, mover and leaver automation from HR events, through API-based connectors | Access reviews |
| AI agents | Not agent-specific yet: client credentials tokens for any software client | Agents with their own identity, policy decisions and decision records |
| Running Keymate | Self-hosted on your Kubernetes, air-gapped with Enterprise | A managed service, run by us |
- Theme
- Identity
- Available today
- Users, organizations and federation; account changes through Keymate's API
- Next
- SCIM 2.0 provisioning
- Theme
- Authentication
- Available today
- Single sign-on, multi-factor authentication with step-up, organization-aware tokens
- Theme
- Authorization
- Available today
- A decision on every request, six policy models, five enforcement points
- Available today
- Optional approval, simulation, versions, evidence records, time-bound access
- Theme
- Identity Governance
- Available today
- Joiner, mover and leaver automation from HR events, through API-based connectors
- Next
- Access reviews
- Theme
- AI agents
- Available today
- Not agent-specific yet: client credentials tokens for any software client
- Next
- Agents with their own identity, policy decisions and decision records
- Theme
- Running Keymate
- Available today
- Self-hosted on your Kubernetes, air-gapped with Enterprise
- Next
- A managed service, run by us
Identity Governance
Keymate Identity Governance keeps each person's access matched to their current job. Joiner, mover and leaver automation from HR events is available today, through API-based connectors set up for your HR system. Access reviews are on the roadmap: a manager or application owner periodically checks that each person still needs the access they hold.
Segregation-of-duties rules and an access request catalog are not part of the module today. The Identity Governance page describes the module and its limits.
AI agents: what works today and what comes next
Giving each AI agent its own identity is on the roadmap: an agent authenticates, receives policy decisions and leaves evidence like any other identity, evaluated together with the person it acts for. That would cover each tool call an agent makes through the Model Context Protocol (MCP).
Nothing in Keymate today is built for agents in particular. What it has works for any software client. A service signs in with the OAuth client credentials grant and receives tokens the same policies apply to. Token exchange lets it trade a token for one with a narrower audience before it calls the next service.
Further reading
- Why AI agents need fine-grained authorization: why a valid token does not settle what data an agent may reach, what the current standards work on agent identity covers and leaves open, and the April 2026 incident in which a coding agent deleted a production database in about nine seconds.
- Fine-grained authorization for AI agents: the approach our engineers presented at Java Day Istanbul 2026, which evaluates the agent and the person it acts for together, with a demo that sends an agent's calls through an MCP server and runs one policy through five scenarios.
Questions
Who governs AI agent access in the enterprise?
The same team that already governs people's access. An agent acting for a person reaches data on that person's behalf, so it belongs under the same policies, approvals and records. In Keymate, giving each agent its own identity is on the roadmap. An agent will then sign in, get a decision on every request and leave a record of each one, so the approval trail for agent access sits next to the one for people.
How do I authorize MCP servers and AI agents?
Put the decision outside the agent: check every call an agent makes to a tool or an API against a policy that considers the agent and the person it acts for, and record the decision. Authorizing tool calls made through the Model Context Protocol (MCP), and giving each agent its own identity, are on Keymate's roadmap. Today any software client that signs in with the OAuth client credentials grant gets tokens the same policies apply to. The enforcement deep dive shows where its requests are decided.
What authorization capabilities do AI agents need?
An agent needs four things. A decision on every request, not only once at sign-in. Rules that look at the agent and the person it acts for together, plus conditions such as tenant, channel and risk. A decision taken outside the agent, so the agent cannot widen its own access. And an explanation and a record for every allow and deny. Keymate makes per-request decisions with explanations and decision records today; applying them to agents as identities of their own is on the roadmap.
Does Keymate offer a managed service?
Not today. Keymate is self-hosted only and runs on your Kubernetes, including fully air-gapped networks with the Enterprise plan. A managed service run by us is on the roadmap. We publish no date and no service levels for it yet.
When will access reviews be available?
Keymate publishes no dates for roadmap items. Identity Governance handles joiners, movers and leavers today, through API-based connectors for your HR system; access reviews are on the roadmap.