IDENTOS Launches PolicyArc, Bringing Real-Time, AI-Ready Access Control to the Enterprise

TORONTO — IDENTOS, a leading Canadian identity, privacy, and authorization company, today announced that PolicyArc is now generally available. The new solution gives security, platform, and compliance teams a single place to define, enforce, and audit access policy across their applications. PolicyArc is built to solve one of the fastest-moving problems in enterprise software: how to safely extend access not just to people and services but to the AI agents now acting on their behalf.

“Most systems only know how to grant broad, standing access. That’s fine for a person, but reckless for an agent.” – Alec Laws, CTO, IDENTOS

PolicyArc builds on more than 12 years of IDENTOS identity and access work across Canadian government and healthcare systems.

Companies are adopting AI agents that act inside their systems, pulling data, taking actions, and making decisions. Traditional access control wasn’t built to give an agent just enough access, for just long enough, and nothing more. According to IBM and Ponemon Institute’s 2026 Cost of a Data Breach Report, 92% of organizations that experienced an AI-related breach lacked proper AI access controls. PolicyArc is designed to address that risk, along with a more familiar challenge: access policies that are slow to change and difficult to audit.

• Safe access for AI agents. People can grant an AI agent a scoped, time-limited version of their own access. It’s enough for the agent to do its job, and it’s automatically revoked when the task or window ends.
• Consent, enforced every time. Access isn’t just checked against policy; it’s checked against what the data owner has actually agreed to, on every request, not just at login.
• Decisions based on what’s happening right now. Access decisions combine standing facts (a person’s role, whether they’ve verified their identity) with real-time context (how sensitive the resource is, what stage a workflow is in) to allow, deny, or ask for extra verification in the moment.
• One policy, everywhere, updated in minutes. Define a resource type once and the policy applies consistently across every connected application. New resource types and policies can be added without rewriting integrations, so access rules keep pace with the product instead of trailing behind it.
• An audit trail by default. Every access decision is automatically logged and reportable. Audit and compliance evidence exists from day one, instead of being reconstructed after the fact.

PolicyArc is built for the teams who own access decisions and have to answer for them: platform and security engineering leads managing authorization across a growing product surface, compliance and risk leaders who need to prove access was appropriate, and teams shipping AI-agent features who need a safe way to delegate access without building that infrastructure themselves.

“Today marks a natural evolution for IDENTOS in the era of AI. PolicyArc takes everything we’ve learned about access and identity and applies it to the question every enterprise is now asking: how to adopt AI without losing control.” – Mike Cook, CEO, IDENTOS “Most systems only know how to grant broad, standing access. That’s fine for a person, but reckless for an agent. We built PolicyArc so a team can hand an agent exactly the permission it needs for one task, nothing more. When the task ends, the access disappears, and every decision is on record.” – Alec Laws, CTO, IDENTOSAvailability PolicyArc is generally available now: https://policyarc.com/About PolicyArc
PolicyArc, powered by IDENTOS, is the authorization layer for regulated enterprises. It decides, enforces, and proves every access decision, so that security teams can adopt AI with accountability built in. Designed for every AI agent, service, and person across the tools organizations already run. Learn more at policyarc.com.

IDENTOS is Canada’s leading identity, privacy and authorization company securing enterprise AI and enabling connected, citizen-facing digital services. Founded in 2014, the company has spent over a decade pioneering access for sensitive enterprise systems, differentiating itself in some of the most complex and regulated sectors, such as health and government, where reliable access control is fundamental to delivering critical services. IDENTOS is ISO 27001 and SOC 2 Type II certified, with all products built on 100% Canadian data residency. IDENTOS’s core product is PolicyArc, a policy-based access control platform. For more information, visit

.

Follow IDENTOS on LinkedIn: linkedin.com/company/identos-inc Media assets, including logos, images and executive headshots, are available through this link.

Contacts

Jessika Chabot, Senior Communications Manager