Put the rules in place.
Build a policy step by step and review what it allows. Publish a version, then choose which identity keys use it.
TKeeper Hub
Know what you’re
about to approve.
Manage policies, keys, and day-to-day operations with your team and AI agents. Use the workspace or connect through MCP, with permissions and approvals enforced by Keeper.
Get to know
your workspace.
From defining a policy to checking an audit record, the tools you need are close at hand.
Give approvals their context.
See the request, who needs to approve it, and how it finished. Manage the people and services that can provide approval.
Work with the right inputs.
Use a request form for the selected authority. Sign, compose, or verify a signature, and inspect the result.
Keep track of the system.
Inspect key generations and expiration dates, verify audit records, and manage each Keeper peer from its current state.
For your team.
And your AI agents.
Connect AI agents to Hub through MCP to manage keys, policies, and operations. They use the same services as the workspace, with the authenticated user’s permissions and the approvals each action requires.
Connect an AI agentHub for enterprise
At home in your
infrastructure.
Deploy Hub on-premises and give your team a shared workspace for TKeeper operations.
Discuss enterprise access
TKeeper Hub
A workspace within the environment your team manages.
- Deployment
- On-premises
- Access
- Your organization’s OpenID Connect sign-in
- Enforcement
- Policy and approval checks remain with Keeper
A closer look.
Do we need to write policies as code?
Hub includes a visual policy editor with fields for request inputs, conditions, and approval requirements. You can review the resulting rules and open the YAML or JSON source when you need it.
Can we use our organization’s sign-in?
Hub supports OpenID Connect. The workspace shows the actions available to the signed-in user, based on their permissions.
Can AI agents manage Keeper through Hub?
Yes. Hub’s MCP tools let AI agents manage keys, policies, operations, inventory, audit, and Keeper peers. Each call uses the authenticated user’s permissions. Keeper still enforces the policies and approvals required for the action.
Can a compromised Hub authorize actions on its own?
No. Hub inherits the signed-in user’s permissions and uses one-time mandates tied to a specific operation. Compromising Hub alone does not grant independent access to Keeper or bypass the authorization, policies, and approvals required to execute an action.
What happens to data in the demo?
The demo uses local sample data and does not connect to a Keeper deployment. Reloading or resetting clears your changes.