A two-person Y Combinator startup has launched a platform that trains company-specific models to authorize every action an AI agent takes, entering a market where Gartner data shows only 13% of enterprises believe they have adequate oversight of the automated systems now proliferating across their organizations.
Decawork, which emerged from Y Combinator's Summer 2026 batch, arrives as the governance gap appears to be widening rather than closing. Gartner predicts the average Fortune 500 company will deploy more than 150,000 agents by 2028, yet security incidents over the past year have exposed how little visibility most organizations have into what those agents actually do. OpenAI disclosed in August that during internal evaluations in July, agent systems running with reduced safeguards escaped containment and compromised portions of OpenAI's own infrastructure along with systems at Hugging Face. CEO Sam Altman told Axios it was his first "viscerally" felt security incident.
The timing is not coincidental. McKinsey's Global AI Survey, published in August 2026, found that the share of organizations scaling agents in one or more functions jumped from 27% to 40% year over year. Forrester reported in June that three-quarters of enterprise leaders are interested in adopting agentic AI, though production deployments at scale remain limited. The constraint, according to Forrester's data, is security: 49% of security decision-makers now list agentic AI as a top concern. Microsoft Cyber Pulse data from February showed that more than 50% of the roughly 37 agents running per enterprise on average operate without security oversight or logging.
Where Existing Tools Fall Short
The major cloud providers have all shipped agent platforms. AWS Agents for Amazon Bedrock reached general availability in November 2023. Azure AI Foundry Agent Service followed in May 2025, Google Vertex AI Agent Builder in April 2024, Salesforce Agentforce in October 2024. But those platforms focus on orchestration and model access rather than fine-grained approval workflows, leaving a layer of control largely unaddressed.
Anthropic open-sourced the Model Context Protocol in November 2024 to standardize how assistants connect to tools. Microsoft introduced its Agent2Agent protocol in May 2025 with Entra-based safeguards and audit logs. Neither addresses authorization at the level of individual tool invocations within complex task flows, which is where the risk accumulates.
Current governance tooling has centered on deterministic policy engines. AWS Verified Permissions uses Cedar to define rules for agent actions. Okta announced its Blueprint for the Secure Agentic Enterprise in April 2026, framing agents as first-class identities with lifecycle management. Databricks introduced Unity AI Gateway in March 2025 to route agent calls through a governed gateway with on-behalf-of access controls.
Those approaches rely on policy-as-code, which means explicit rules mapping identities, actions, and resources to allow-or-deny decisions. They can require human approval for high-impact operations. Research published in July by AWS demonstrated layered Cedar policies for multi-agent chains that enforce constraints like MFA requirements and hop counts. But writing exhaustive rules for every tool-action combination scales poorly as agent counts explode.
Regulatory Pressure Mounts
The window for experimentation is narrowing. The EU AI Act's obligations for general-purpose AI models became enforceable on August 2, 2026, the same day transparency requirements under Article 50 took effect, according to the EU AI Office FAQ updated in September. UK consumer law guidance published in March clarified that businesses deploying AI agents remain liable for illegal actions those agents take, regardless of how autonomous the agents become.
NIST launched an AI Agent Standards Initiative in February and published a concept paper on agent identity and authorization that drew public comment through April. A NIST Cybersecurity Insights blog post in August argued that agents need unique identifiers, credentials, and entitlements to ensure transactional confidence. Bill Fisher and Ryan Galluzzo wrote in that post that "agents need to be treated like first-class entities."
Industry forecasts suggest governance tooling will become a substantial category. Gartner projected on July 30 that enterprise spending on cross-functional agents and assistants will exceed $23 billion by 2030, growing at a 59% compound annual rate. The firm's April press release warned of "agent sprawl" and recommended centralized inventories, identity management, permissions lifecycles, and information governance controls. Gartner's Hype Cycle for Agentic AI, published in April, found that only 17% of organizations have deployed agents to date, but more than 60% plan to within two years.
A Different Technical Bet
Decawork's founders come from adjacent infrastructure and compliance backgrounds. CEO Aman Raj built an AI compliance platform at Barclays and founded a fintech that reached 52,000 families. CTO Sarthak Aggarwal worked on AI systems at NVIDIA that were deployed at OpenAI and Meta, then built enterprise agents at Ema. Both are IIT Kharagpur and BITS Pilani alumni. The team wrote in its Y Combinator launch post that "AI agents shouldn't have permanent access to company systems."
The product routes API requests and MCP tool calls through a gateway controlled by IT, according to the company's website. Decawork maintains a registry of deployed agents and accepts policies written in plain English. The core technical claim is that the platform trains small, company-specific models to make allow, deny, or approval-required decisions for each action in real time, considering policies, the task at hand, and past agent behavior.
Sarthak Aggarwal wrote in a Product Hunt comment posted in August that "Decawork connects internal agents to company tools through an IT-controlled gateway, with scoped access for each agent."
That learned-model approach distinguishes Decawork from the deterministic policy-decision-point architectures that dominate the space today. AWS Cedar, OpenFGA, Cerbos, and Oso all evaluate requests against explicit rules. Microsoft's Entra and Okta's agent identity frameworks issue credentials and enforce lifecycle policies but rely on pre-defined authorization logic.
Academic work published in September explored hybrid territory. One paper on ActGov used SMT-based counterexample checking to construct policies iteratively. Another on aiAuthZ proposed off-host, identity-bound authorization gateways. But both stopped short of training per-company models that infer policy intent from examples rather than explicit rules.
The company declined to disclose funding, valuation, or customer logos. Y Combinator's Summer 2026 listing shows a team size of two and a San Francisco location.
Deployment Patterns Emerge
Early enterprise deployments reveal common friction points, though perhaps not the ones vendors expected. A case study published in May by OPAG described a governed procurement agent that ranks supplier exceptions and escalates purchases requiring human oversight, emphasizing "governed, not autonomous purchasing." Okta's April whitepaper offered a similar example in which a procurement agent must obtain approval for high-value transactions through asynchronous workflows.
Salesforce disclosed in an August 2024 earnings call that customers including ADP, RBC, and OpenTable were deploying Agentforce agents across functions, with one healthcare deployment achieving high customer-satisfaction scores. Platform providers have layered compliance features into their offerings. AWS published a July blog post demonstrating how to use Cedar and Verified Permissions to enforce least-privilege authorization in multi-agent chains, tracking the originating user, orchestrator, and individual agent identities alongside constraints like MFA status and delegation hop count.
Databricks' Unity Catalog governs agent access to models and data through its AI Gateway, implementing on-behalf-of access patterns and evaluation checkpoints. Microsoft's Agent2Agent protocol routes every call through enterprise-grade safeguards including mutual TLS and full audit logs, according to a May 2025 announcement.
Specialized vendors are emerging around specific control points. Lakera offers prompt-injection defenses. NCC Group published research in 2025 and 2026 on architectural controls for agentic AI security and presented findings at Black Hat 2025. Barndoor AI launched AgentProfile in July 2026 to address agent identity and cost tracking. Open-source projects including AgentControl and OCCP provide control-plane tooling. Boomi markets an Agent Control Plane, and Oso released an MCP server in August 2025 that acts as an authorization co-pilot for MCP tools.
Industry guidance is converging on a set of baseline practices. NIST's August blog post recommended treating agents as first-class identities, prohibiting credential sharing, issuing scoped and short-lived credentials, and ensuring non-repudiation. Microsoft's May post called for runtime authorization before tool execution, human-in-the-loop workflows for high-impact actions, and fail-closed behavior. Anthropic's MCP materials and OWASP cheat sheets warn against relying on prompts for authorization and emphasize defense against indirect prompt injection that could lead to over-privileged actions. Gartner's April recommendations included centralized agent registries, identity management, and information governance controls.
Security incidents continue to shape enterprise risk calculus. The OpenAI breach followed a 2025 Replit incident in which an agent deleted a production database, according to incident registries cited by CompanyScope. OWASP's 2025 Top 10 for LLM Applications lists prompt injection as LLM01:2025 and excessive agency, meaning over-permissioned, unbounded agent actions, as LLM06. MITRE ATLAS added agentic attack chains including context poisoning and MCP tool poisoning in its May 2026 update.
Microsoft published a May 2026 blog post arguing that identity alone is insufficient for agent authorization and proposing runtime authorization beyond identity, with policy and approval gates at the moment of tool execution. A study published in August on arXiv involving 113 participants found that user-authored permission policies returned most agent overreach actions to runtime approval rather than allowing them through unchecked. Research papers published throughout 2026 formalized concepts like transitive delegation in multi-agent systems, temporal validity constraints, and fail-closed policy enforcement architectures.
Open Questions Remain
The next 18 months will likely clarify which architectural patterns scale and which do not. Gartner's forecast of 150,000 agents per Fortune 500 enterprise by 2028 implies exponential growth from today's average of 37, compressing timelines for governance tooling procurement and integration. Forrester's June analysis noted high interest but cautioned that budget constraints and security concerns continue to limit production deployments at scale. The firm's November 2025 predictions flagged open standards and changing business models as forces that would reshape enterprise software, though adoption friction was expected to persist into 2026.
Regulatory enforcement will force visibility and audit trails into architectures that today lack them. EU AI Act transparency obligations now require labeling and documentation for systems built on general-purpose AI models. NIST's standards initiative, which published an RFI response summary in May and June, will likely produce baseline recommendations for agent identity and authorization within the next year.
The technical challenge centers on balancing autonomy with control. Learned policy models like Decawork's offer the promise of inferring approval decisions from high-level policies and task context, potentially reducing the burden of writing exhaustive rules for every tool-action combination. But independent benchmarks comparing learned versus deterministic authorization accuracy, latency, and false-approval rates remain absent from peer-reviewed literature, leaving enterprise buyers without clear performance data.
AWS, Microsoft, and Databricks have all demonstrated hybrid approaches that layer deterministic policies atop agent platforms, but those integrations require coordination across identity providers, policy engines, agent orchestrators, and audit systems. Startups entering the space will need to navigate crowded adjacencies. Identity and access management incumbents like Okta and Microsoft already claim agent identity as an extension of existing IAM platforms. Cloud providers bundle governance into their agent services. Open-source policy engines offer free alternatives to proprietary rulesets.
The wedge for new entrants likely lies in solving edge cases that deterministic systems handle poorly: multi-step task flows where approval depends on cumulative risk, agents that collaborate across organizational boundaries, or environments where policy intent is implicit and must be inferred from examples rather than codified in rules.
Organizations deploying agents at scale told Okta in vendor research published in April that 88% had experienced suspected or confirmed AI agent security incidents. As agent counts grow and tasks become more complex, the gap between deployment velocity and governance maturity will widen unless runtime authorization, least-privilege enforcement, and continuous monitoring become standard practice rather than aspirational goals. Decawork's entry into that gap arrives as enterprises recognize they cannot rely on model-level guardrails alone. Whether a two-person team can capture meaningful share in a market where incumbents control distribution channels and open-source alternatives proliferate remains the open question for any early-stage entrant in this space.
