GrayPass

GrayPass is a Y Combinator (F26) startup that checks who is actually in control of a session right before a sensitive action runs, including whether an AI agent is acting on someone's behalf. It launched publicly on October 28, 2026. Login proves who entered; GrayPass checks whether the expected person is still in control when the important action arrives, and returns a decision your app enforces: allow, verify again, hold or deny.

Website: graypass.com · Launch post: Aditya Ranjan on X

Key points

1. The gap it fills: authentication happens at login, but sessions stay valid long after. By the time a consequential action (a payment, a data export, an account change) arrives, the evidence behind that login has aged, and the actor may now be a different person or an AI agent.
2. Brainprint: GrayPass's privacy-preserving, tenant-scoped model of how an enrolled person interacts with software: pointer movement and click timing, keystroke timing (not the words typed) and scrolling rhythm. It adds continuity evidence but doesn't establish identity or permission on its own.
3. Evidence it weighs: identity, device, session and transaction context plus Brainprint continuity, measured against your policy for that specific action.
4. Action-bound proof: authorization is tied to the exact action your application is about to execute.
5. Works with your stack: you keep your identity provider, passkeys and MFA; GrayPass adds fresh assurance at the moment of action.
6. Traction claimed at launch: 900K+ sessions processed and $50K in revenue that month. GrayPass also publishes research such as "The Shape of Identity" and "The Chain of Intent" on agency and delegation.

How to get started

• Request an evaluation or open the demo console on graypass.com. The site says it is accepting a new batch of evaluations until November 30.
• Integration point: your server requests an authorization decision before executing a sensitive action, then enforces the result.

Good fits

• Fintech and banking flows such as transfers and payee changes
• Admin consoles and data exports
• Products that let AI agents act for users and need to tell agent activity from the user's own

Note

When evidence is missing or uncertain, your own policy decides whether to require fresh approval or send the action to review.