Oso

• AWS, Okta, or another platform the buyer already owns could make fine-grained authorization a native feature, turning Oso's standalone engine into a checkbox before the field consolidates.
• Oso's agent enforcement is documented but unproven in the public record, so a buyer has no independent account of how blocking and approval holds behave against real agent traffic.
• Oso's traction figures are vendor-stated and dated to 2023, so a growth stall would stay invisible in the public record until it surfaced in hiring or the terms of a next raise.
• The open-source library that built Oso's following is now deprecated, so the developer mindshare it generated could erode if paid Oso Cloud does not carry that community forward.
• Sitting between employee agents and the models they call puts Oso in the live path, where added latency or a block that fires wrongly becomes a production problem rather than a missed alert.
• If enterprises standardize agent controls on the identity providers they already own, Oso's per-agent layer could become optional middleware.

Oso sells authorization, the layer that decides what a logged-in user or service is allowed to do inside an application. The company separates this from authentication, the login step that identity providers like Okta already handle, and argues that developers have long been forced to build fine-grained access control by hand. The New Stack notes that broken access control tops OWASP's Top 10 web application security risks, which grounds the problem independently of Oso's marketing.

Oso now frames the same problem around AI agents, which take on the access a person holds and act on it far faster than a person can. Its own research with Cyera, the Least Privilege Report 2026, is the headline evidence, reporting that 96 percent of enterprise permissions go unused. That figure is vendor research rather than an independent measurement, so the agent-specific pain is asserted more than it is independently quantified. Neray's argument to The New Stack is sharper than the statistic: companies accept a degree of over-permissioning because a human has a finite limit on the time and resources available to do damage, and an agent does not.

The buyer has historically been the engineering leader who owns an application's access model, which fits Oso's developer-first, inbound motion. The agent framing widens that to the security team now accountable for the AI agents employees run, and Oso's account of why it turned to them is that seven years of building permissions for humans showed why those models fail for agents. What Oso offers that team is no longer observation alone but rules that block an agent's tool call or hold it for approval. [s8, s15, s5, s3]

Oso Cloud is a centralized authorization service built on Polar, a logic programming language Oso created for expressing permission systems, running over SQLite. Polar can model role-based, relationship-based, and attribute-based access control, and applications query Oso Cloud over HTTP or an SDK to get back a boolean, a list, or logic to run against their own database. Oso backs the engine with extensive public documentation and an open-source library that first built its following, which Neray told TechCrunch had been downloaded millions of times. That library is now deprecated, though Oso says it will keep providing support and critical bug fixes.

Oso for Agents extends the company into securing the AI coding agents employees run on their own devices, and it covers both watching them and stopping them. Oso inventories the agents running across endpoints and browsers, captures every prompt, completion, and tool call in a session, and alerts on unsanctioned agents or sensitive data. Its policy documentation then defines what happens next: a rule can alert the team, block the call outright, or hold it until the end user or the security team approves it, enforced centrally at the network level.

The mechanism behind that enforcement is documented as well. Oso sits between the agents and the models they talk to, installing process hooks distributed through the buyer's device management, routing agents that accept a custom model endpoint through its own proxy, and capturing web-based agents with a browser extension. One limit is stated plainly. When a rule matches content in a tool's response, the call has already run, so blocking redacts the response rather than preventing the action.

External validation is strongest for the core authorization work and thinnest for the agent line. The New Stack covered Oso's fine-grained authorization approach and its automated-least-privilege argument for AI. An independent comparison of authorization policy languages documents a crowded field, with managed services from AWS's Cedar, Auth0 and Okta's OpenFGA, and Cerbos, the same market Oso's Polar sells into, and that comparison does not mention Oso at all. A third-party catalog lists Oso as an active SaaS product and describes its agent discovery, monitoring, and alerting, but no third party in the cited record has evaluated the enforcement Oso documents. [s2, s7, s14, s3, s16, s17, s8, s13, s9]

Oso competes in fine-grained application authorization, a field that has not settled on a standard. An independent comparison documents several purpose-built policy languages and managed services, including AWS's Cedar and Verified Permissions, Auth0 and Okta's OpenFGA, and Cerbos. Oso's differentiation is the Polar language and a hosted engine that answers authorization questions against a customer's own data.

Identity providers and cloud vendors are adjacent competitors. AWS Verified Permissions and Okta's FGA have shipped fine-grained authorization to the same developers Oso sells to. Oso's counter is its dedicated Polar language and hosted engine.

The move into agent security opens a second front against many of the same players, because governing what an agent may do is ground the identity providers and cloud vendors that already ship authorization can also occupy. What Oso has that the cited comparison does not attribute to them is a documented way to stop an agent mid-action, blocking a tool call or holding it for approval from a central point in the network. Oso's bet is that a company already governing human and service access will want one place to govern agents too, which keeps its core relevant as buying shifts toward agents. [s13, s3, s16, s1]

Oso shows real customer traction for its core product. Its homepage carries a logo wall naming Verizon, Visa, Duolingo, PagerDuty, Productboard, and others, and it publishes signed endorsements from the infrastructure lead at Roblox and the chief information security officer at Brex. The motion has been product-led and inbound. Neray told TechCrunch in 2023 that the company grew without outbound sales and had no salespeople at the time, and that Oso Cloud's recurring revenue was rising 20 percent month over month.

The agent product is sold differently. Its published plans run from a free Developer tier for three users to a Growth tier at $15 per user per month for twenty-five, then to a custom Enterprise tier that adds data residency, on-premises deployment, and around-the-clock support. Every one of those tiers routes through a demo booking, and the documentation says access is arranged by meeting the chief executive, so the published prices set expectations rather than close a sale. Pricing counts humans who invoke agents, not agents, with no cap on the agents behind one user.

Oso raised an $8.2 million Series A led by Sequoia in 2021 and a $15 million Series B led by Felicis in 2023, which TechCrunch reported as over $25 million raised in total, a figure Neray said meant no other authorization company had raised more at that point. On that capital and a small team, Oso grew through inbound demand and its open-source following, though it discloses no revenue and the one growth figure it has shared dates to 2023, so capital efficiency stays unconfirmed. Independent records corroborate the company's footing: TechCrunch covered both rounds, and Oso Security Inc. filed a Form D with the SEC for an earlier raise, a regulatory record listing founders Graham Neray and Samuel Scott and a 2018 incorporation in Delaware. [s1, s7, s4, s3, s6, s12]

Oso rests on two publicly identifiable co-founders. TechCrunch identifies Graham Neray and Samuel Scott as co-founders, the company's SEC Form D lists both as executive officers and directors alongside a 2018 incorporation, and Neray is chief executive today. Leadership has changed below him: TechCrunch identified Scott as chief technology officer in 2021, and the company now lists Nick Kucharski in that role. The record documents no prior exit, so what they have built at Oso since 2018 is the main evidence of their ability.

The team has built a body of authorization content. Oso publishes an Authorization Academy of technical guides on application authorization, and Neray argues the case in the technical press that permissions built for humans break once an agent inherits them. That publication record is a real but modest signal, one educational resource rather than a category-defining reputation.

The company has been small, which is part of the story. TechCrunch reported nine employees in 2021 and 13 in 2023, a lean headcount for a company with Oso's customer list. The about page now names a bench beyond the founders covering sales, marketing, operations, and a founding engineer, so the leadership surface is wider than it was, though public detail on those backgrounds is thin. [s12, s6, s5, s1, s7, s8]

Oso publishes the baseline assurance an enterprise buyer expects. The company announced SOC 2 certification in a 2023 post, and its security page states that Oso is SOC 2 certified, describes encryption of customer data in transit and on disk, and says production releases go through peer review. Both statements come from Oso's own pages rather than from a published report.

Access to the underlying documents is indirect. The security page points buyers to a Vanta-hosted trust center for compliance reports and policies rather than publishing them on the page itself, and the cited page does not state the trust center's access terms. That matters more here than for a passive tool. Oso Cloud sits on an application's authorization path, and the agent product records every prompt and tool call and can block or redact them, so confirming data-handling terms and failure behavior belongs in the evaluation rather than after it. [s10, s11, s2, s16, s17]

Add analyzed competitors to compare them side by side with Oso.

Oso sells to the team that owns an application's access model. Historically that is the engineering leader who must decide what each user or service can do inside the product, which fits the product-led, inbound motion Oso's chief executive described to TechCrunch in 2023, when Oso Cloud's revenue was growing without outbound sales. The current pricing page publishes a free Developer tier capped at three users, but that page prices Oso for Agents rather than Oso Cloud, so it evidences the agent line's entry motion and not the historical developer one. The company positions authorization as distinct from the login step identity providers handle.

The agent line points at the security team inheriting AI agents. Oso argues that access models built for humans do not fit agents, which take on broad human-scale permissions and act at machine speed, so the buyer becomes whoever is accountable for the agents employees run. That buyer is now offered enforcement rather than observation alone, and the documentation routes access through a meeting with the chief executive, so the agent motion reaches its buyer through a conversation rather than a signup.

The core capability is a hosted authorization engine driven by a purpose-built language. Applications send an authorization question to Oso Cloud over HTTP or an SDK, and the service evaluates it against policies written in Polar and customer-provided authorization facts, returning an allow-or-deny decision or a filtered list. Polar can express role-based, relationship-based, and attribute-based models.

The agent capability now spans observation and enforcement. Oso for Agents inventories agents across endpoints, browsers, and network traffic, captures every prompt, completion, and tool call in a session, and alerts on unsanctioned agents or sensitive content. Its policy documentation defines rules that match an actor, an operation, and a resource, then respond by alerting, blocking the call outright, or holding it for user or security approval, applied centrally at the network level. One documented limit is worth naming: when a rule matches content in a tool's response, the call has already run, so blocking redacts the response instead of preventing the action.

The engineering is real but reproducible. The New Stack covered Oso's fine-grained authorization approach, and the field it competes in already holds several purpose-built languages and managed services, from AWS's Cedar to Auth0 and Okta's OpenFGA and Cerbos. Polar's language and Oso Cloud's APIs are publicly documented, a now-deprecated open-source library carried an earlier engine, and the agent line's own mechanism is documented interception plus a condition-and-response rule builder, so the record shows no unique asset a rival would have to license, though rebuilding either service would take real work.

Oso built its growth on a product-led, inbound motion. Neray told TechCrunch in 2023 that the company grew without outbound sales and that Oso Cloud's recurring revenue was rising 20 percent month over month, and that motion produced named reference customers, including Duolingo, Intercom, and Productboard. The agent product runs on a different motion, because every published plan calls for booking a demo and the documentation says access is arranged by meeting the chief executive.

Pricing is per user, defined as a human who invokes agents, with no limit on the agents each user runs. The published plans start at a free Developer tier capped at three users, rise to a Growth tier at fifteen dollars per user per month capped at twenty-five, and reach a custom Enterprise tier, which keeps the entry price low while pushing any real deployment into a negotiation.

The verifiable traction is the named customers and the funding history, not independently reported scale. TechCrunch covered the 2021 Series A and the 2023 round, Oso Security Inc. filed a Form D with the SEC, and the homepage now carries agent-era endorsements from leaders at Roblox and Brex alongside its earlier developer testimonials. The cited coverage still relays company-provided growth figures rather than independently verified revenue or customer counts.

The Oso for Agents pricing page charges per user and publishes a free Developer tier, while Oso Cloud's pricing model is not published there. It defines a user as a human who invokes agents, with no limit on the number of agents per user, which signals that Oso wants to price by the people directing agents rather than by agent volume.

The tiers gate capability as well as headcount. The free Developer tier carries the audit trail and default alerts for three users, the Growth tier at fifteen dollars per user adds leak and risky-tool detection for twenty-five, and Enterprise adds SIEM export, data residency, on-premises deployment, and a custom user count. Every tier routes through a demo booking, so the published numbers set expectations rather than close a sale. The per-user meter also raises a question every agent-era vendor faces, because usage driven by many agents under one human user may not track the value delivered.

Oso Cloud is delivered as a hosted service on the application's authorization path. Applications call its APIs to answer authorization questions, so availability and latency are core to the product, and the documentation also describes local and hybrid deployment options that keep decisions closer to the application.

Oso for Agents sits between agents and the models they call. It captures traffic through process hooks pushed to endpoints by mobile device management, a network proxy for agents that accept a custom model endpoint, and a browser extension for web-based agents, and it attributes each session to a user, a group synced from an identity provider, and a device correlated with the buyer's endpoint detection inventory. Because a policy can block a call or hold it pending approval, adoption puts Oso in the live path of employee agent traffic rather than beside it, which raises what a buyer should ask about latency and failure behavior and raises what the product can change.

Oso publishes the baseline assurance enterprise buyers expect. It announced SOC 2 certification in 2023, and its security page states that Oso is SOC 2 certified and describes customer data isolation, encryption in transit and at rest, enforced two-factor authentication, and peer-reviewed production change control.

Access to the underlying documents is indirect. The security page points buyers to a Vanta-hosted trust center for compliance reports and policies, and that trust center failed to load during the fetch recorded here, which leaves self-service access unconfirmed in this record rather than ruled out. A buyer should retry the trust center and, if it still does not load, ask Oso for the SOC 2 report directly. For a service on the authorization path that, in the agent line, records prompts and tool calls and can block or redact them, confirming data-handling terms matters before adoption.

Oso's platform bet is to be the one place a company expresses authorization. Oso Cloud centralizes access logic that would otherwise scatter across services, and the pitch is that engineering and security teams manage one policy engine rather than many hand-built checks.

The agent line extends the pitch to non-human callers, and it now enforces rather than only reports. The two lines remain separate in the fetched record, because the agent product's rules are built from actor, operation, and resource conditions rather than written in Polar, and the documentation does not say the agent product runs on the Oso Cloud engine, so the shared-engine thesis is positioning rather than documented architecture.

The exposure is that identity providers and cloud vendors offer competing managed authorization services and policy engines, from AWS's Cedar-based Verified Permissions to Okta's FGA. The comparison this record cites treats those engines as alternatives that differ in syntax, performance, formal verification support, and tooling rather than as drop-in equivalents, so the competitive question is which model fits a given application.

Oso rests on two identifiable co-founders. TechCrunch identifies Graham Neray and Samuel Scott as co-founders, the company's SEC Form D lists both and a 2018 incorporation, and Neray is chief executive today. TechCrunch identified Scott as chief technology officer in 2021, and the company now lists Nick Kucharski in that role. The record documents no prior exit.

The team publishes technical content and was small at its last reported counts. TechCrunch reported nine employees in 2021 and 13 in 2023, and Oso maintains an Authorization Academy of guides on application authorization. That lean headcount fits the capital-efficient read, and the about page now names a bench beyond the founders that covers sales, marketing, operations, and a founding engineer, though public detail on their backgrounds is thin.