Alter, a Y Combinator startup, launches access control for multi-user AI agents

·2 views

Alter, a startup from Y Combinator's S25 batch, has launched a product that controls what AI agents can do when acting for multiple users. The founders note that agents often connect to systems like CRMs or billing tools through a single shared API key, which lets them perform any action that key allows, regardless of who the user is. Alter operates as a proxy that manages downstream credentials, factors in the identity of the end user for each action, and enforces fine-grained runtime policies. It also produces compliance-grade audit logs. The founders say the product is aimed at developers building agents in regulated industries and reports early users including startups and a defense contractor.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Lessons from running a 200-game browser arcade on instant-play design

A contributor who helps run PlayPokiGame, a free site of casual HTML5 games playable in-browser without downloads or signups, shares lessons from observing real player behavior. Time-to-interactive proved the strongest predictor of play sessions, with games showing a playable frame within about three seconds drawing far more engagement. The author also found that browser players skip tutorials, so controls should be shown in-game, and that short 10–20 minute play bursts favor games with natural 3–5 minute loops. Instant respawns, auto-pausing on tab blur, and periodic localStorage saves are highlighted as key to keeping players from abandoning games. The author argues these principles apply broadly to web products, given the browser runs on everything from cheap Chromebooks to high-end workstations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Browser-based HEIC to JPG conversion for iPhone photos using JavaScript

iPhones save photos in HEIC format by default, which is smaller than JPG but often rejected by websites, forms, and Windows apps. Because only Safari can natively decode HEIC, the author recommends the heic2any library, which uses WebAssembly to convert files directly in the browser. The library is about 1.3 MB, so it is loaded only after a user selects a HEIC file to keep page loads fast. Developers are advised to handle multi-image HEIC outputs as arrays, check file extensions since MIME types can be empty, convert files sequentially to limit memory use, and use a quality setting of 0.9. Since the file never leaves the user's device, the approach also suits private photos.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five On-Premises Project Management Tools Compared on Data Control and Workflow Fit

Organizations that must keep project records on infrastructure they manage need to weigh deployment options alongside approval steps, status reporting, and daily usability. A new practitioner's guide compares five tools on deployment and data control, workflow coverage, and operational fit. It recommends first confirming hosting requirements, then testing each candidate against a representative project from planning through reporting. The guide profiles ONES.com, Jira Data Center, Microsoft Project Server, Wrike, and OpenProject Enterprise, noting each one's strengths and caveats such as Jira Data Center's announced end-of-life timeline. Its suggested evaluation method is to trace a requirement through planned work and execution updates to see whether it surfaces in project reporting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Treat LLM Agents Like New Bank Tellers: Five Controls That Transfer

A developer with a background in financial systems argues that LLM agents with tool access resemble new bank employees who are fast but cannot reliably distinguish genuine customers from fraudsters. The author suggests that long-established banking controls can be applied to these agents. Key recommendations include enforcing policy in code rather than in prompts, using a gate that checks each proposed tool call before execution, and treating retrieved document content as untrusted data to limit prompt injection. The piece also recommends detailed logging of every proposed tool call, including rejections, and using velocity checks to detect fraud patterns.

0 comments Read more at DEV Community