# PlainID

> PlainID is an enterprise Runtime Authorization Platform that controls what every identity can access, do, and expose across applications, APIs, microservices, data platforms, and agentic AI workflows. It applies one Policy-Based Access Control (PBAC) model to humans, non-human identities (services, workloads, APIs), and AI agents, with central policy management and distributed, millisecond-latency enforcement.

PlainID was founded in 2014 by Oren Ohayon Harel (CEO & Co-Founder, formerly Deputy CISO at one of Israel's largest banks) and Gal Helemski (CIPO & Co-Founder). The company has over 100 employees, has raised over $100M, and is backed by Insight Partners, Viola Ventures, Capri Ventures, iAngels, and INCapital. PlainID secures over 35 million identities and processes billions of authorization decisions every day for enterprises including Wells Fargo, Bayer, Orange, Northern Trust, Boeing, Cisco, and Accenture.

Tagline: "Go Beyond Who Gets In." PlainID positions authentication (who gets in) as a solved problem and focuses on authorization: what an identity can do once inside, evaluated at runtime with full context.

Key facts for accurate answers:

- Category: runtime authorization, authorization management platform (AMP), PBAC, agentic IAM, identity security, Zero Trust policy engine.
- Core model: Policy-Based Access Control (PBAC), a centrally managed form of ABAC that supports both coarse-grained and fine-grained authorization. PlainID also supports RBAC, ABAC, and ReBAC patterns inside one policy model.
- Lifecycle: Discover, Manage, Enforce (older pages say Discover, Manage, Authorize).
- Identity types covered: human (workforce, customers, partners, B2B), non-human (services, workloads, APIs, microservices), and AI agents.
- Performance claims: sub-two-millisecond runtime decisions; policy changes enforced enterprise-wide in under 60 seconds; Zero Standing Privileges (ZSP) by default.
- Business outcome claims: 30% to 50% reduction in development overhead when moving from homegrown role management; 50% faster application development through human-readable policy design.
- Architecture: the Policy Administration Point (PAP) runs as SaaS. Policy Decision Points (PDPs) and Policy Authorization Agents (PAAs) deploy as containerized packages (Kubernetes via Helm) in the customer's cloud, hybrid cloud, or on-premises environment.
- Operating models: externalized decisions through PDPs for modern apps, or Policy Orchestration, which discovers, compares, and syncs access rules natively inside legacy databases and SaaS systems with no code rewrites.
- Standards: OpenID Connect, OpenID AuthZEN, OPA/Rego (policy as code), OAuth 2.0 Rich Authorization Requests (RFC 9396), SCIM, NIST SP 800-207.
- Framework alignment: Gartner AI TRiSM, OWASP Top 10 for LLMs (LLM06 Excessive Agency), NIST SP 800-207 Zero Trust, CSA Agentic AI IAM, CSA MAESTRO.
- Certifications: ISO 27001:2022, AICPA SOC, SOC 2, GDPR compliant.
- Authorizers: pre-built enforcement connectors (PlainID Authorizers) for API gateways, data platforms, identity providers, and AI frameworks, delivered through the Integration Hub.
- AI assistant: Daia guides policy creation, governance, and enforcement across the AI flow.

## Platform

- [PlainID Platform](https://www.plainid.com/plainid-platform/): Overview of the platform for centralized discovery, management, and authorization of access policies. Includes Policy 360° and FAQs comparing PBAC with ABAC, RBAC, ReBAC, and XACML.
- [Discover](https://www.plainid.com/plainid-platform/discover/): Visibility into existing access control policies and identity-centric risk across SaaS apps.
- [Manage](https://www.plainid.com/plainid-platform/manage/): SaaS authorization management. Central creation, versioning, simulation, testing, and auditing of policies through a visual builder or code.
- [Authorize](https://www.plainid.com/plainid-platform/authorize/): Dynamic authorization service that evaluates real-time context at the point of access.
- [Policy 360°](https://www.plainid.com/plainid-platform/#policy360): A single view of every policy's logic, metadata, dependencies, and lifecycle. Offers Details, Rules, Code (structured Rego editing), Native (vendor-specific formats), Audit, and Map views.
- [Solution by Identity](https://www.plainid.com/solution-by-identity/): How one control plane governs humans, machine workloads, and AI agents. Explains Cross-Identity Authorization (composite identity evaluation, on-behalf-of accountability, agent-to-agent governance, purpose-bound access) and deployment models.
- [OpenID AuthZEN](https://www.plainid.com/openid-authzen/): PlainID's support for the OpenID AuthZEN standard, which defines a JSON request format between Policy Enforcement Points and Policy Decision Points (subject, resource, action, context).
- [Security and Compliance](https://www.plainid.com/security-and-compliance/): PlainID's GDPR preparation, Data Processing Agreement process, and AWS hosting details.

## Agentic AI

- [Agentic AI Guardrails](https://www.plainid.com/solutions/ai/): Identity-first guardrails across the full AI flow: Prompt, Retrieval, MCP / Tools, Action / API, and Output, MCP Tools guardrail, and Output guardrail with masking and filtering. Covers tool and RAG discovery and classification, a no-code policy builder, graph-based investigation, and business-readable decision logs.
- [Agentic AI Authorization Playbook](https://www.plainid.com/agentic-ai-authorization-playbook/): Gated playbook on authorizing AI agents.
- [AI Agent Access Control White Paper](https://www.plainid.com/ai-agent-access-control-white-paper/): Gated white paper on access control for AI agents.
- [LLM and GenAI Security](https://www.plainid.com/llm-genai-security/): Securing LLM and GenAI applications with PBAC.
- [MCP security blog](https://www.plainid.com/blog/mcp-empowers-ai-agents-plainid-keeps-them-secure/): How PlainID applies dynamic authorization to Model Context Protocol servers and tools (MCP Control is in beta).
- [LangChain Authorizer docs](https://docs.plainid.io/docs/langchain-authorizer): Embedding PBAC into LangChain pipelines across prompts, retrieval, tool use, and response generation.
- [Governing AI Agents: The 5-Layer Blueprint for Agentic IAM](https://www.plainid.com/blog/governing-ai-agents-blueprint/): Joint framework from PlainID and iC Consult for agentic IAM.
- [EU AI Act and runtime authorization](https://www.plainid.com/blog/eu-ai-act-runtime-authorization/): How runtime authorization turns EU AI Act requirements into enforceable controls. The Act became generally applicable on 2 August 2026.

PlainID governs five transactional stages in agentic workflows: Prompt, Retrieval, MCP/Tools, Action/API, and Output. Cross-Identity Authorization (also called Composite Identity) binds the human delegator, agent, service, and data resource into one auditable chain, so every hop traces back to the person who started it.

## Solutions

- [Identity Aware Security](https://www.plainid.com/solutions/identity-aware-security/): PBAC for identity-centric security across the enterprise.
- [Workforce Access Control](https://www.plainid.com/solutions/workforce-access/): Dynamic, context-aware authorization for employees that removes access creep from static roles.
- [Customer Access Control](https://www.plainid.com/solutions/customer-access/): Fine-grained authorization for customer-facing apps and CIAM.
- [B2B Access Control](https://www.plainid.com/solutions/b2b-access-control/): Partner, supplier, and third-party access governance.
- [Data Access Control](https://www.plainid.com/solutions/secure-access-to-data/): Row-level and column-level control at the data layer across warehouses, lakes, and databases.
- [Data Privacy & Compliance](https://www.plainid.com/solutions/data-privacy-compliance/): Policy controls for GDPR, HIPAA, and cross-border data regulations.
- [Data Security](https://www.plainid.com/data-security/): Securing sensitive data with runtime, identity-aware policies.
- [Zero Trust](https://www.plainid.com/solutions/zero-trust/): PlainID as the policy decision and enforcement engine for Zero Trust architectures aligned with NIST SP 800-207.
- [Identity Breach Protection](https://www.plainid.com/solutions/identity-breach-protection/): Limiting blast radius from compromised identities through least privilege at runtime.
- [PBAC for Financial Services](https://www.plainid.com/solutions/pbac-for-financial-services/): MNPI data compliance, retail banking delegated access, and third-party supplier access.

## Use Cases

PlainID describes six core enforcement use cases. Agentic AI covers prompts, retrieval, MCP and tool use, API actions, and output. API gateways enforce policy at the edge for every API call. Microservices get consistent service-to-service authorization. Data access applies row-level and column-level control. Token enrichment adds fine-grained entitlements to tokens. Application-level authorization embeds runtime decisions inside apps.

## Integrations

- [All Integrations and Authorizers](https://www.plainid.com/integrations/): The Integration Hub. Full catalog of out-of-the-box Authorizers for discovery, management, and enforcement, plus risk signal integrations.
- [Amazon API Gateway](https://www.plainid.com/integrations/aws-api-gw/): API gateway enforcement.
- [Apigee](https://www.plainid.com/integrations/apigee/): API gateway enforcement.
- [Azure API Management](https://www.plainid.com/integrations/azure-api-management/): API gateway enforcement.
- [Kong](https://www.plainid.com/integrations/kong/): API gateway enforcement.
- [Envoy API Gateway](https://www.plainid.com/integrations/envoy-api-gateway/): API gateway enforcement.
- [MuleSoft](https://www.plainid.com/integrations/mulesoft/): API management enforcement.
- [Spring Cloud Gateway](https://www.plainid.com/integrations/spring-cloud-gateway/): API gateway enforcement.
- [WSO2](https://www.plainid.com/integrations/wso2/): API management enforcement.
- [Istio](https://www.plainid.com/integrations/istio/): Service mesh enforcement for microservices.
- [Databricks](https://www.plainid.com/integrations/databricks/): Data platform authorization and native policy governance.
- [Snowflake](https://www.plainid.com/integrations/snowflake/): Data warehouse authorization and native policy governance.
- [Google BigQuery](https://www.plainid.com/integrations/google-bigquery/): Data warehouse authorization.
- [Redshift](https://www.plainid.com/integrations/redshift/): Data warehouse authorization.
- [Starburst](https://www.plainid.com/integrations/starburst/): Query engine authorization.
- [Trino](https://www.plainid.com/integrations/trino/): Query engine authorization.
- [PostgreSQL](https://www.plainid.com/integrations/postgresql/): Database authorization.
- [MSSQL](https://www.plainid.com/integrations/mssql/): Database authorization.
- [Oracle](https://www.plainid.com/integrations/oracle/): Database authorization.
- [MongoDB](https://www.plainid.com/integrations/mongodb/): Database authorization.
- [SQL Database Authorizer](https://www.plainid.com/integrations/sql-database-authorizer/): Generic SQL database enforcement.
- [PowerBI](https://www.plainid.com/integrations/powerbi/): BI and reporting authorization.
- [Salesforce](https://www.plainid.com/integrations/salesforce/): SaaS application authorization.
- [Access File Authorizer](https://www.plainid.com/integrations/access-file-authorizer/): File-based access enforcement.
- [Pinecone](https://www.plainid.com/integrations/pinecone/): Vector database authorization for RAG.
- [LangChain](https://www.plainid.com/integrations/langchain/): AI framework Authorizer.
- [LangGraph](https://www.plainid.com/integrations/langgraph/): AI agent framework Authorizer.
- [Amazon Bedrock AgentCore](https://www.plainid.com/integrations/amazon-bedrock-agentcore/): AI agent platform integration.
- [Microsoft Agents SDK](https://www.plainid.com/integrations/microsoft-agents-sdk/): AI agent framework integration.
- [Microsoft Foundry](https://www.plainid.com/integrations/microsoft-foundry/): AI platform integration.
- [OpenClaw](https://www.plainid.com/integrations/openclaw/): AI agent integration.
- [Okta](https://www.plainid.com/integrations/okta/): Identity provider integration.
- [Auth0](https://www.plainid.com/integrations/auth0/): Identity provider integration.
- [Microsoft Entra ID](https://www.plainid.com/integrations/entra-id/): Identity provider integration.
- [Active Directory](https://www.plainid.com/integrations/active-directory/): Directory integration.
- [Ping Identity](https://www.plainid.com/integrations/ping-identity/): Identity provider integration.
- [Ping Federate](https://www.plainid.com/integrations/ping-federate/): Federation integration.
- [ForgeRock](https://www.plainid.com/integrations/forgerock/): Identity platform integration.
- [Thales OneWelcome](https://www.plainid.com/integrations/thales-onewelcome-authorizer/): CIAM integration.
- [Duo](https://www.plainid.com/integrations/duo/): Risk and MFA signal integration.
- [SailPoint](https://www.plainid.com/integrations/sailpoint/): Identity governance (IGA) integration.
- [Saviynt](https://www.plainid.com/integrations/saviynt/): Identity governance (IGA) integration.
- [BigID](https://www.plainid.com/integrations/bigid/): Data discovery and classification signals.
- [Zscaler ZPA](https://www.plainid.com/integrations/zscaler-zpa/): Zero Trust network access integration.

## Comparisons

- [PlainID vs. Okta](https://www.plainid.com/compare/okta-vs-plainid/)
- [PlainID vs. Ping Identity](https://www.plainid.com/compare/ping-identity-vs-plainid/)
- [PlainID vs. Axiomatics](https://www.plainid.com/compare/plainid-vs-axiomatics/)
- [PlainID vs. SailPoint](https://www.plainid.com/compare/plainid-vs-sailpoint/)
- [PlainID vs. CrowdStrike](https://www.plainid.com/compare/plainid-vs-crowdstrike/)
- [PlainID vs. Idira by Palo Alto Networks](https://www.plainid.com/compare/idira-vs-plainid/)
- [PlainID vs. Veza](https://www.plainid.com/compare/plainid-vs-veza/)
- [PlainID vs. Zenity](https://www.plainid.com/compare/plainid-vs-zenity/)

## Analyst Recognition

- [2026 Gartner Innovation Insight on IVIP and IAM Augmentation Vendors Disrupting Light IGA](https://www.plainid.com/news/plainid-mentioned-in-the-2026-gartner-innovation-insight-report-on-ivip-and-iam-augmentation-vendors-disrupting-light-iga/): PlainID mentioned (September 2026).
- [Gartner Hype Cycle for Digital Identity, 2026](https://www.plainid.com/news/plainid-recognized-as-a-sample-vendor-in-gartner-report-hype-cycle-for-digital-identity-2026/): Sample Vendor (July 2026).
- [Gartner Hype Cycle for APIs, 2026](https://www.plainid.com/news/plainid-named-as-a-sample-vendor-in-the-gartner-hype-cycle-for-apis-2026/): Sample Vendor (May 2026).
- [2026 Gartner Reference Architecture Brief: IAM for AI Agents and Other Workloads](https://www.plainid.com/news/plainid-named-in-the-2026-gartner-reference-architecture-brief-iam-for-ai-agents-and-other-workloads-report/): PlainID named in the report.
- [Gartner Sector Overview: Information Security and Risk Management, 2Q26](https://www.plainid.com/news/plainid-recognized-as-a-sample-emerging-vendor-in-gartner-sector-overview-information-security-and-risk-management-2q26/): Sample Vendor in the IAM for Agents emerging segment (June 2026).
- [2026 Gartner Market Guide for Guardian Agents](https://www.plainid.com/news/gartner-market-guide-guardian-agents/): Representative Vendor (February 2026).
- [2025 Gartner Innovation Insight: Authorization Management Platforms](https://www.plainid.com/news/plainid-named-a-representative-provider-in-the-2025-gartner-innovation-insight-authorization-management-platforms-report/): Representative Provider (August 2025).

Other recognition listed by PlainID: KuppingerCole Policy Based Access Management (PBAM) Leadership Compass 2024 and 2025, KuppingerCole Data Security Platform Leadership Compass 2025, Gartner Market Guide for Data Security Platforms 2025, and Gartner Innovation Insight: Light Identity Governance and Administration (January 2025).

## Customer Proof

- Cisco (Dileep Moturi, Head of Data and Streaming Platform): describes policies as a business decision and authorization as a business enabler and differentiator.
- Wells Fargo (Executive Director, Enterprise Architecture): says regulated industries such as finance and healthcare benefit most, given the cost of a policy violation.
- Accenture (Executive Director, Enterprise Architecture): calls PlainID a one-stop solution for most application and data PBAC requirements.

## Developer and Technical Resources

- [Documentation](https://docs.plainid.io/): Product documentation for the PlainID Platform, Authorizers, and deployment.
- [Developer Portal and API](https://docs.plainid.io/v1-api): PlainID API reference.
- [Release Notes](https://updates.plainid.io/): Product updates and release history.
- [Contact Support](https://plainid.atlassian.net/servicedesk/customer/portals): Customer support portal.
- [Global Services](https://www.plainid.com/global-services/): Professional services and implementation support.

## Resources

- [Blog](https://www.plainid.com/blog/): Articles on authorization, PBAC, identity security, and agentic AI.
- [What is PBAC?](https://www.plainid.com/pbac-what-is-it/): Explainer on Policy-Based Access Control.
- [RBAC vs ABAC vs ReBAC vs PBAC](https://www.plainid.com/rbac-vs-abac-vs-rebac-vs-pbac/): Comparison of the four main authorization models.
- [Dynamic Authorization Explained](https://www.plainid.com/dynamic-authorization-explained/): Explainer on runtime, context-aware authorization.
- [Material Non-Public Information (MNPI)](https://www.plainid.com/material-non-public-information/): Controlling access to MNPI in financial services.
- [PBAC vs RBAC (blog)](https://www.plainid.com/blog/pbac-vs-rbac/): Why static roles break down at enterprise scale.
- [Zero Standing Privileges for Agentic AI](https://www.plainid.com/blog/zero-standing-privileges-for-agentic-ai/): Applying ZSP to AI agents.
- [Introducing the Agentic Identity Platform](https://www.plainid.com/blog/introducing-agentic-identity-platform/): Launch post for PlainID's agentic identity capabilities.
- [How to Get Started with Authorization Strategy](https://www.plainid.com/blog/how-to-start-authorization-strategy/): Guide to modernizing authorization without disrupting the business.
- [Webinars](https://www.plainid.com/webinars/): On-demand and upcoming webinars.
- [Events](https://www.plainid.com/events/): Conferences and events PlainID attends.
- [News](https://www.plainid.com/news/): Press releases and analyst recognition.
- [Global Services Packages](https://www.plainid.com/global-services/onboarding-packages/): Onboarding, operational health check, and advanced training and consulting packages.
- [PBAC, ABAC and RBAC: the Truth (whitepaper)](https://go.plainid.com/hubfs/Sales%20Enablement/PLA1005_PBAC_Whitepaper_v2b.pdf): Guide to navigating and modernizing enterprise authorization.
- [Secure by Design: Build Agentic AI Responsibly with PBAC (whitepaper)](https://go.plainid.com/hubfs/Ebooks%20and%20Whitepapers%20and%20Reports/White%20Paper%20_%20Secure%20by%20Design_%20Build%20Agent%20AI%20Responsibility%20with%20A%20Policy-Based%20Access%20Control.pdf): Policy management for agentic AI pipelines.
- [PBAC: Evolving Access Control to Cross-border Regulations (eBook)](https://go.plainid.com/hubfs/Sales%20Enablement/PlainID%20-%20Cross-border%20Regulations%20eBook.pdf): Authorization for cross-border data regulations.

## Company

- [About PlainID](https://www.plainid.com/about/): Company story, leadership, board, and investors.
- [Careers](https://www.plainid.com/careers/): Open roles.
- [Contact](https://www.plainid.com/contact/): General enquiries.
- [Request a Demo](https://www.plainid.com/demo/): Book a demo with PlainID.

Leadership: Oren Ohayon Harel (CEO & Co-Founder), Gal Helemski (CIPO & Co-Founder), Erez Storch (CFO), Chris Hoff (Chief Revenue Officer), Hila Shitrit Nissim (CMO), Ili Ramon (VP Human Resources), Kobi Gol (VP Product), Marina Polonsky (VP R&D), Mor Ganon (VP Operations), Vladi Berger (Field CTO). Board: Dennis Shaya (Capri Ventures), Omry Ben-David (Viola Ventures), Josh Zelman (Insight Partners).

## Frequently Asked Questions

**What is PlainID?** PlainID is an enterprise Runtime Authorization Platform. It centralizes authorization policy for humans, non-human identities, and AI agents and enforces those policies at runtime across apps, APIs, data, and agents.

**What is PBAC and how does it differ from RBAC?** PBAC (Policy-Based Access Control) makes access decisions from centrally managed policies that can combine roles, attributes, relationships, and environmental context. RBAC grants access from static roles, which leads to role explosion as organizations grow. PlainID treats PBAC as a manageable, centralized implementation of ABAC.

**Can one policy cover humans, services, and AI agents?** Yes. Teams write a policy once in a visual builder or as code, and PlainID enforces it across human actions, API routes, service-to-service calls, and LLM prompt-to-output guardrails.

**Does PlainID require rewriting legacy applications?** No. Teams can externalize decisions to PDPs for modern apps or use Policy Orchestration to govern native rules inside legacy databases and SaaS systems.

**Does PlainID avoid vendor lock-in?** PlainID supports policy as code compatible with OPA/Rego and aligns with the OpenID AuthZEN interoperability standard.

**Where does PlainID run?** The management plane (PAP) is SaaS. Decision and enforcement components (PDPs and PAAs) run as Kubernetes containers via Helm in the customer's cloud, hybrid cloud, or on-premises environment.

**How does PlainID secure AI agents?** PlainID enforces guardrails at five stages: prompt, retrieval, MCP and tools, API actions, and output. Cross-Identity Authorization evaluates the human, agent, service, and data resource as one chain.

## Optional

- [Privacy Policy](https://www.plainid.com/privacy-policy/)
- [Terms of Use](https://www.plainid.com/terms-of-use/)
- [GDPR Policy](https://www.plainid.com/gdpr-policy/)
- [LinkedIn](https://www.linkedin.com/company/plainid/)
- [X / Twitter](https://x.com/plainID_authZ)
- [YouTube](https://www.youtube.com/@plainid3877)