Our first wave of AI agents carried broad, long-lived permissions “just in case,” which quietly inflated the blast radius of each workflow. Orca shows effective permissions and actual usage side by side for agents and identities, so we can clearly see which rights are actually exercised and which are dead weight. That context gave us the confidence to move toward just-in-time access.

Teams across the company started spinning up AI agents that could call APIs, trigger workflows, and act on behalf of users, and a few of those agents ended up with far more access than anyone realized. Orca surfaces those agents alongside everything else in our cloud estate, showing which identities they run as, which services they can reach, and what data sits behind those permissions. Seeing that blast radius in a single view made it straightforward to decide which agents were actually needed, where scopes should be tightened, and where guardrails should be added before they caused any trouble.

We looked at platforms that had clearly retrofitted or acquired their AI security story. With Orca, AI agents and AI services are built natively into the same unified data model that has powered the platform from day one, from code to the cloud runtime. Instead of a set of stitched-together tools, agents now show up directly in our workflows, our data pipelines, and the product our customers use, and Orca treats that entire agent footprint as a first-class part of the attack surface rather than an afterthought.