The fastest-growing category of worker in your company has no face, no contract, and a key to the till.
The money has noticed. Saviynt, an identity security company, closed 700 million dollars in Series B growth equity at a valuation of around 3 billion, led by KKR with Sixth Street Growth, TenEleven and Carrick Capital participating. It was the largest cybersecurity round of its year. The company does not build agents. It builds the list of who is allowed to be one, governing access for human staff, machine identities and AI agents across a company’s applications, data and infrastructure, now across more than 600 enterprise customers including over a fifth of the Fortune 100. Meanwhile the funding into agent platforms themselves keeps arriving, most recently for Genera, backed by Round Capital alongside BoxGroup, Carpenter Capital and Success Venture Partners.
Read those two flows together and the shape of the moment is clear. Capital is no longer only paying for agents that can do the work. It is paying, at scale, to answer a question most companies skipped: who let them in.
Think about how you would actually hire a barista. They arrive, they learn the machine, they are trusted with the grinder before the espresso settings and the espresso settings well before the safe. Nobody writes this down. It is not a policy. It is just the sensible order in which a person earns the run of the place, and it exists because the shop learned, once, what happens when it does not.
The agent skipped all of it. It arrived fully staffed on day one, was pointed at the calendar, the inbox, the customer records and the billing system in a single afternoon, and never once stood at the counter proving it could froth milk. Legacy access systems were designed for a human with a static job description who logs in during the morning and out in the evening. An agent operates continuously and decides in real time. The old shape does not fit the new hire.
Here is the part that matters to anyone building something small. This is not a large-enterprise problem that will arrive for you in five years. It is a founder problem, and it is already here, because the smallest teams are precisely the ones granting the widest access with the least ceremony. There is no IT department to slow you down. That is the advantage, and it is also the whole risk in a single sentence.
So the discipline is not to move slower. It is to keep the list. Every agent, every integration, every service that got a key in the last eighteen months, what it can reach, and who decided that. Most founders cannot produce that list today. Not because they were careless, but because access was never granted as a decision. It was granted as a default, one convenient afternoon at a time, and defaults do not announce themselves.
Write it down this week. It takes an hour and it will be the cheapest hour of the quarter, because the alternative is discovering the list later, during the incident, assembled by somebody else and read back to you.
The agent will work all night without complaining, without a break, and without ever asking for a raise.
Just make sure somebody in the building knows which keys it is holding while it does.
