Both put guardrails between your AI agents and the systems they reach, but at different layers. PolicyLayer governs what every MCP tool call is allowed to do. Keycard governs who the agent is and the credentials it carries. Here is where each one fits.
Two products, two layers of the same problem. They overlap on scoped tokens and audit, and differ on what they actually enforce.
PolicyLayer is the gateway your MCP traffic runs through. Connect your servers and every tool call (the refund, the merge, the DROP, the delete) is checked against deterministic, deny-by-default policy before it executes: allow, deny, rate-limit, or require approval, with argument-level rules and a per-call audit log.
Keycard is an identity and access platform for agents. It builds a composite identity from the user, device, agent, and task, and issues short-lived, identity-bound credentials through OAuth token exchange, so an agent carries a scoped credential per hop instead of a borrowed static key.
The dimensions enterprise teams actually evaluate when they put agents into production.
| PolicyLayer | Keycard | |
|---|---|---|
| Primary job | Enforce policy on what the agent does: every MCP tool call | Establish who the agent is and issue the credential it acts with |
| Enforcement point | Inline MCP gateway in the request path; the call is checked before it runs | At credential issuance: policy decides whether a scoped token is minted |
| Policy model | Deterministic, deny by default, argument-level rules in a visual editor and as code | Policy evaluated when a credential is requested |
| Granularity | Per tool and per argument (deny refunds over $1k, block DELETE without WHERE) | Per resource and scope on the issued credential |
| Identity | Per-person and per-agent scoped grant tokens routed through the gateway | Composite identity: user + device + agent + task, with workload and device attestation |
| Credentials | Upstream keys held by the gateway and injected; agents only ever hold a scoped grant | Ephemeral, identity-bound tokens via OAuth token exchange (RFC 8693), per hop |
| Approvals | Approval gates on any tool call; allow, deny, rate-limit, or require human sign-off | Step-up authorization for sensitive or destructive operations |
| MCP coverage | MCP-native: gateway, a server and tool directory, and per-tool risk classification | MCP supported alongside A2A, CLI, and API agent surfaces |
| Audit | Every tool call logged with the tool, its arguments, and the allow or deny decision | Real-time telemetry stream of identity, credential, and policy events |
| Deployment | Hosted control plane and gateway; route your existing MCP servers through it | SDKs (TypeScript, Python), a gateway, and a keycard run CLI for coding agents |
| Best fit | Teams routing AI clients through MCP servers who want deterministic guardrails on actions | Teams building agents that need delegated identity and scoped downstream credentials |
They refund, merge, run SQL, and change infrastructure through MCP servers, and you want a deterministic check on the call itself before it executes.
Not just which tool, but the call: deny refunds over a threshold, block DELETE without a WHERE clause, require a change-ticket id.
You connect Claude Code, Cursor, or your own agents to MCP servers and want one place to set and audit policy across them.
Sensitive calls wait for human sign-off, and every call is recorded with its arguments and decision.
You need an SDK that establishes agent identity and issues delegated credentials as the agent calls downstream services.
Access should depend on the agent running on a verified, hardware-attested device or runtime.
Credentials need to narrow at every handoff across agents and services, anchored to the originating user.
The two are not mutually exclusive. Keycard can establish agent identity and issue a scoped credential; PolicyLayer enforces deterministic policy on each MCP tool call that credential is used to make. Identity answers who is acting; PolicyLayer governs what the action is allowed to do.
Whatever your agents touch, the same engine, audit, and access model is doing the work underneath every rule you write.
Rules run as code, not model judgement: argument-level conditions, quotas, deny-by-default. The same call gets the same decision every time.
Writing policies →Your security or compliance team writes and attaches policy without ever holding the upstream credentials or grant tokens.
Roles →Every call is logged with its decision and the rule that fired, attributed to the identity, in an append-only record. Argument values are redacted, never stored.
Logs & security →Upstream secrets are encrypted at rest and injected by the gateway. The agent only ever holds a scoped token.
Logs & security →Every person and agent connects with its own scoped grant. Rotate or revoke any one of them instantly, without disrupting the rest.
Core concepts →Hosted gateway. Point your clients at it, register a server, issue a token. Nothing to install.
Quick start →No. PolicyLayer issues per-identity scoped grant tokens for routing MCP traffic and works with your existing SSO and identity. Its focus is enforcing deterministic policy on every tool call, not being the system of record for identity.
Yes. They sit at different layers. Keycard can establish agent identity and issue scoped credentials; PolicyLayer enforces policy on the MCP tool calls those credentials make, with argument-level rules and a per-call audit log.
It inspects the call itself. A scoped credential controls which systems an agent can reach; PolicyLayer controls what it can do there: denying a refund over a limit, a DELETE without a WHERE clause, or a change to a protected resource, on every call.
No. Agents keep the same tools and schemas. PolicyLayer enforces policy on each call (allow, deny, rate-limit, or require approval), apart from any tools you deliberately hide.
Deterministic, deny-by-default policy on every MCP tool call: approval gates, per-identity scopes, argument-level rules, and a tamper-proof audit log. Route your existing MCP servers through the gateway, live in minutes.
Instant setup, no code required.