AI agent authorization startup Arcade nabs $60M investment

Arcade AI Inc., the developer of an authorization platform for artificial intelligence agents, today announced that it has raised $60 million in funding. 

SYN Ventures led the Series A round. It was joined by Morgan Stanley and Wipro Ltd., a publicly traded technology consulting firm.

The process of giving an AI agent access to a business application comprises two steps. The first step verifies that the agent has permission to use the program. The second step, which is known as authorization, defines the specific application features that the agent may use. Arcade has developed a platform that simplifies the latter workflow for enterprises.

The company was founded in 2024 by Chief Executive Officer Alex Salazar and Chief Technology Officer Sam Partee, who previously held senior product roles at Oka Inc. and Redis Inc., respectively. Today’s funding round was preceded by a $12 million seed raise last year.

Developers historically had to build custom authorization mechanisms for their AI agent projects. Arcade’s platform provides prepackaged authorization features that reduces the need for custom code. According to the company, that saves time and avoids the bugs often associated with ad hoc cybersecurity guardrails.

Arcade determines which agent can access what application feature by integrating with companies’ IdP system. An IdP is a database that tracks application access permissions. If a record in a company’s IdP changes, Arcade can modify AI agent permissions accordingly, which removes the need for manual updates.

When users authorize an AI agent to access a particular application feature, the access permission is typically valid round-the-clock. That means hackers who gain access to the agent can compromise the application with relative ease. Arcade says its platform narrows the attack surface by only authorizing specific agent actions.

The system performs authorization using a popular open-source protocol called Oath 2.0. The technology manages agents’ access to applications using pieces of data called OATH tokens, which serve a similar role as passwords.

It stores OTH tokens to spare developers the hassle of managing them. It encrypts them before rather than after sending them to storage, which makes it more difficult for hackers to decipher the data. For added measure, Arcade has equipped its platform with a so-called salting mechanism. It mitigates the cybersecurity risks associated with credentials that have identical plaintext values.

Arcade enables companies to log the actions of agents powered by its platform. Additionally, it provides access to more than 8,000 MCP tools that those agents can use to automate work tasks.

“Agents don’t fail in production because the model is wrong,” Salazar said. “They fail because nobody can prove that for any given action by an agent, whether that agent on behalf of that user can perform that action on that resource. That’s what we built.”

Arcade will use its new funding to expand its platform’s agent governance features and MCP tool catalog.

Image: Unsplash