1Password, a leader in identity security, today launched 1Password Privileged Access. The launch extends the 1Password® Unified Access platform into Privileged Access Management, helping security teams control just-in-time, just-enough access to critical infrastructure with zero standing privilege. The launch anchors a broader platform update that also includes the public preview of 1Password Credential Broker for GitHub Actions and new 1Password Enterprise Password Manager capabilities for developer and AI security.
“Most organizations have more standing access in their environments than they can see or justify,” said David Faugno, CEO of 1Password. “That invisible access creates exposure, and too often, companies discover it only after an attacker does. As AI agents act on behalf of employees, access must be granted for a specific task, limited to what the work requires, and removed when the work is done.”
Eliminating Standing Access Across Critical Infrastructure
Standing access rarely appears all at once. It accumulates across systems and infrastructure through daily work. The task ends, but access for employees, service accounts, and IAM roles remains. AI agents increase the potential blast radius because they can inherit the privileges of the people who deploy them or retain access to the credentials they receive. 1Password’s recent research found that 40% of developers grant agents persistent access to systems or credentials, underscoring how easily access can persist after a task is completed. That makes an old access problem move at machine speed: more identities, more systems, and more permissions that can persist after the work is done.
1Password Privileged Access provisions access at the moment it is requested, scopes it precisely to the task, and deprovisions it automatically when the work is done. Built on the capabilities of Apono, which joined 1Password in June 2026, 1Password Privileged Access provisions permissions directly in the target system’s native policy layer, across cloud environments, databases, and developer infrastructure, without replacing the tools their teams already use. This ensures the agent never needs direct access to the underlying credentials.
With 1Password Privileged Access, organizations can:
- Discover overprivileged access: Track identities and permissions across cloud, databases, and Kubernetes environments to find access that has accumulated over time and should be reclaimed or right-sized.
- Provision just-in-time access: Create accounts or privileges at the time of request, scoped to the task, and revoked automatically at the end of each session.
- Maintain compliance evidence without manual log review: Every request, approval, and access event is logged with full attribution for SOC 2, HIPAA, PCI-DSS, ISO 27001, and GDPR.
- Govern access based on risk: Apply risk-based approvals without slowing engineers down, with low-risk requests auto-approved by policy and higher-risk requests routed to a reviewer through tools such as PagerDuty, Slack, Microsoft Teams, or Jira.
Delivering Credentials When AI Agents and Workloads Need Them
As AI agents move into production, teams need a secure, scalable way to deliver credentials only when they are needed. 1Password Credential Broker, now in public preview for GitHub Actions, issues credentials scoped to each individual workflow run, so teams can keep long-lived static secrets out of pipeline configurations. Before releasing any credential, 1Password Credential Broker verifies that the requesting identity is trusted, scopes the credential to that specific request, and logs every delivery.
Together, 1Password Privileged Access and Credential Broker extend the Unified Access platform across the full runtime access lifecycle. Infrastructure access is provisioned in the target system’s native policy layer. Credentials are delivered at runtime to verified machine and agent identities. Together, these controls make credential requests, delivery, and access auditable across the AI ecosystem.
“Developers are under constant pressure to move faster, but increasingly sophisticated software supply chain attacks have made securing CI/CD pipelines more challenging than ever,” said Ben De St. Paer-Gotch, Director of Product Management at GitHub. “With 1Password Credential Broker for GitHub Actions now in public preview, engineering teams can eliminate secrets from their pipeline configurations, reducing the risk of credential theft while securely providing GitHub Actions with the credentials needed to build and ship software.”
Securing Credentials Where AI-enabled Development Begins
Security teams often lack a reliable view into what credentials exist across developer tools and local machines, who controls them, or whether the access they represent is still needed. That visibility gap grows as credentials accumulate in plaintext on local machines, API tokens end up inside agent context windows, and .env files move between machines and repositories without any record of where they have been. AI coding tools intensify the problem because they rely on those same credentials to develop and deploy code, creating new paths for secrets to end up inside model context windows at a rate that outpaces any credential hygiene process. Three capabilities, now generally available in 1Password Enterprise Password Manager, address this gap.
- Developer Watchtower finds exposed credentials in local .env files and guides developers to secure them in 1Password, while giving administrators visibility into credential risk on developer machines.
- 1Password Environments lets developers import existing .env files into the 1Password vault and access secrets through 1Password’s MCP Server, keeping credentials off disk and out of model context.
- Credential Governance gives administrators a central view into company-owned credentials across employee and shared vaults, the ability to identify and take ownership of company credentials, and control over how those credentials are accessed over time.
Together, these capabilities bring governance to the point where credential risk often begins and where organizational visibility has historically been lowest.
To learn more, visit the 1Password Privileged Access product page. Read more about 1Password Credential Broker on our blog, and explore the new Enterprise Password Manager capabilities here.
About 1Password
1Password is redefining identity security for how people and AI agents work today. The 1Password Unified Access platform discovers and secures identities and credentials, establishes trusted access, and audits actions across humans, machines, and AI agents. 1Password Privileged Access enforces zero standing privilege across critical infrastructure with just-in-time access provisioning and automatic deprovisioning. 1Password SaaS Manager helps organizations discover and secure access to SaaS applications and optimize AI spend. 1Password’s enterprise vault protects more than 1.5 billion credentials and secrets and is trusted by more than 1 million developers and over 200,000 businesses, including Canva, CIBC Capital Markets, Cursor, Dust, ElevenLabs, Figma, GitHub, HackerOne, Hugging Face, MongoDB, Notion, Perplexity, Salesforce, Stripe, Vercel, Wiz, Workday, and Zscaler. Learn more at 1Password.com.
View source version on businesswire.com: https://www.businesswire.com/news/home/20260728163932/en/
Media gallery
