Sallyport and Aembit
Widely sold, and a person never gets to approve a call.
Aembit sells workload identity and it sells it well. Generally available, a public price of $20 per agent per month as of September 2026, three agents free, fifteen downstream services. Their blended identity carries both the human and the workload into every request. If your problem is machine-to-machine access at scale, they are a serious answer.
| Them | Sallyport | |
|---|---|---|
| Server-side injection | Yes | Yes |
| Per-call human approval | None. They bought content inspection instead | This is the product |
| Any HTTP host you hold a key for | Workload access, a fixed set of services | MCP or a plain proxy, any public host |
| Tamper-evident journal | Logging | Hash-chained, signed per entry, keys published |
| Price | $20 per agent, three free | $19 a month for 5 agents, 7 days free |
Where they are ahead
Distribution, maturity and integration depth. They have been shipping for longer, they have customers, and their workload identity model is deeper than ours. If that is your problem, buy theirs.
Where the difference is
When an agent decides to issue a refund at three in the morning, Aembit inspects the content and lets it through. Here, with “ask every time” on, a person answers a card while the call waits. The question and the answer both land in a chain you can verify without us.