1Password has expanded its Unified Access platform with the launch of 1Password Privileged Access, bringing privileged access management (PAM) capabilities to help organizations enforce just-in-time, just-enough access with zero standing privileges. The release also includes the public preview of 1Password Credential Broker for GitHub Actions and new Enterprise Password Manager features designed to strengthen developer and AI security.
“Most organizations have more standing access in their environments than they can see or
justify,” said David Faugno, CEO of 1Password. “That invisible access creates exposure and too
often, companies discover it only after an attacker does. As AI agents act on behalf of
employees, access must be granted for a specific task, limited to what the work requires, and
removed when the work is done.”
Eliminating Standing Access Across Critical Infrastructure
Standing access rarely appears all at once. It accumulates across systems and infrastructure
through daily work. The task ends, but access for employees, service accounts, and IAM roles
remains. AI agents increase the potential blast radius because they can inherit the privileges of
the people who deploy them or retain access to the credentials they receive. 1Password’s
recent research found that 40% of developers grant agents persistent access to systems or
credentials, underscoring how easily access can persist after a task is completed. That makes
an old access problem move at machine speed, more identities, more systems, and more
permissions that can persist after the work is done.
1Password Privileged Access provisions access at the moment it is requested, scopes it
precisely to the task, and deprovisions it automatically when the work is done. Built on the
capabilities of Apono, which joined 1Password in June 2026, 1Password Privileged Access
provisions permissions directly in the target system’s native policy layer, across cloud
environments, databases, and developer infrastructure, without replacing the tools their teams
already use. This ensures the agent never needs direct access to the underlying credentials.
With 1Password Privileged Access, organizations can:
● Discover overprivileged access: Track identities and permissions across cloud,
databases, and Kubernetes environments to find access that has accumulated over time
and should be reclaimed or right-sized.
● Provision just-in-time access: Create accounts or privileges at the time of request,
scoped to the task, and revoked automatically at the end of each session.
● Maintain compliance evidence without manual log review: Every request, approval,
and access event is logged with full attribution for SOC 2, HIPAA, PCI-DSS, ISO 27001,
and GDPR.
● Govern access based on risk: Apply risk-based approvals without slowing engineers
down, with low-risk requests auto-approved by policy and higher-risk requests routed to
a reviewer through tools such as PagerDuty, Slack, Microsoft Teams, or Jira.
Delivering Credentials When AI Agents and Workloads Need Them
As AI agents move into production, teams need a secure, scalable way to deliver credentials
only when they are needed. 1Password Credential Broker, now in public preview for GitHub
Actions, issues credentials scoped to each individual workflow run so teams can keep long-lived
static secrets out of pipeline configurations. Before releasing any credential, 1Password
Credential Broker verifies that the requesting identity is trusted, scopes the credential to that
specific request, and logs every delivery.
Together, 1Password Privileged Access and Credential Broker extend the Unified Access
platform across the full runtime access lifecycle. Infrastructure access is provisioned in the
target system’s native policy layer. Credentials are delivered at runtime to verified machine and
agent identities. Together, these controls make credential requests, delivery, and access
auditable across the AI ecosystem.
“Developers are under constant pressure to move faster, but increasingly sophisticated software
supply chain attacks have made securing CI/CD pipelines more challenging than ever,” said
Ben De St. Paer-Gotch, Director of Product Management at GitHub. “With 1Password
Credential Broker for GitHub Actions now in public preview, engineering teams can eliminate
secrets from their pipeline configurations, reducing the risk of credential theft while securely
providing GitHub Actions with the credentials needed to build and ship software.”
Securing Credentials Where AI-enabled Development Begins
Security teams often lack a reliable view into what credentials exist across developer tools and
local machines, who controls them, or whether the access they represent is still needed. That
visibility gap grows as credentials accumulate in plaintext on local machines, API tokens end up
inside agent context windows, and .env files move between machines and repositories without
any record of where they have been. AI coding tools intensify the problem because they rely on
those same credentials to develop and deploy code, creating new paths for secrets to end up
inside model context windows at a rate that outpaces any credential hygiene process.
Three capabilities, now available in 1Password Enterprise Password Manager, address this
gap.
● Developer Watchtower finds exposed credentials in local .env files and guides
developers to secure them in 1Password, while giving administrators visibility into
credential risk on developer machines.
● 1Password Environments lets developers import existing .env files into the
1Password vault and access secrets through 1Password’s MCP Server, keeping
credentials off disk and out of model context.
● Credential Governance gives administrators a central view into company-owned
credentials across employee and shared vaults, the ability to identify and take ownership
of company credentials, and control over how those credentials are accessed over time.
Together, these capabilities bring governance to the point where credential risk often begins and
where organizational visibility has historically been lowest.
Learn more at https://1password.com/
Read more in this new blog. https://1password.com/blog/survey-ai-agent-adoption-is-outpacing-governance
Related News:
