Compare
Adjacent, not interchangeable.
Most tools in this space answer a different question. Here is the honest map, and where we actually overlap.
01 The categories
Five categories, five different questions.
01
Workload identity brokers
Aembit, Teleport
What they do
Attest a workload, then obtain a short-lived credential and hand it to the caller, so no static secret sits in the application. This is a real improvement over stored API keys, and it is the closest category to us.
Where we differ
Same primitive, opposite direction. They attest a workload in order to give it a credential for the services it calls outward. We use attestation to judge what may call inward, at the boundary of the API you own. A broker does not protect your API from its callers, so deploying one does not remove the need for this.
02
Secrets managers
HashiCorp Vault, cloud secret stores
What they do
Store secrets safely, rotate them, and control who can read them. Essential infrastructure, and most teams should keep theirs.
Where we differ
A vault makes secrets safer to hold. It does not remove the need to hold one. We remove the secret from the flow, so there is nothing to store for this path.
03
API gateways
Kong, cloud API gateways
What they do
Terminate, route, rate-limit, and check that a caller presents a valid token. Excellent at traffic management.
Where we differ
A gateway asks whether the caller holds a valid token. We ask whether this exact request is proven, in scope, fresh, and never seen before. We sit in front of or beside a gateway; nothing is ripped out.
04
Identity providers
Auth0, Descope
What they do
Authenticate people and applications, issue tokens, and manage sessions. Mature, and the right tool for human and customer identity.
Where we differ
Sessions suit humans, who tolerate being trusted for a while. An agent makes thousands of calls and should be judged on each one. We authorize the call, not the session.
05
Machine identity posture tools
inventory and discovery platforms
What they do
Find every machine identity you have and rank the risky ones. Genuinely useful, and it tells you the size of the problem.
Where we differ
Posture tools observe. They do not stand in the request path. We are the boundary that refuses.
Same attestation. Different direction.
Workload identity brokers and Trustplane both use attestation to establish what a calling workload is. They then do opposite things with it. A broker uses it to hand your workloads credentials for the services they call outward. We use it to decide whether a call coming into your API is allowed to proceed. If you own APIs that agents and partners call, that job is still unowned no matter which broker you run.
Comparisons describe each product as its own public documentation describes it, as of September 2026. If we have something wrong, tell us and we will correct it.