-- GrayPass, a San Francisco security company in Y Combinator’s Fall 2026 batch, has introduced post-login assurance for applications that handle money, permissions and sensitive data. The service helps applications assess whether the expected person is still in control before a consequential action takes place, including when an AI agent acts on that person’s behalf.
GrayPass co-founders Arav Mathur and Aditya Ranjan will discuss the shift from proving identity to assessing control in an upcoming interview on Bloomberg TV.
Passwords, passkeys and multifactor authentication establish who enters an application. But a payment, permission change or data export may happen hours later, within a session the application still trusts. GrayPass adds a check at that later moment, using behavioral evidence alongside identity, device, session and transaction context.
Photo Courtesy of GrayPass
Before an application approves a payment, changes a payout account, grants administrator access or exports customer data, GrayPass evaluates the available evidence against the application’s policies. It returns one of four decisions: allow, verify again, hold or deny. The application enforces the result before executing the action.
“A successful login at 9 a.m. doesn’t tell you who’s controlling the session at 2 p.m.,” said Arav Mathur, CEO and co-founder of GrayPass. “Before a sensitive action goes through, you need evidence of who’s behind it, whether that’s the user, an AI agent acting on their behalf or someone else using the session, and whether they’re authorized to take that action.”
Behavioral Evidence Beyond Sign-In
GrayPass’s Brainprint technology models interaction patterns such as typing rhythm, pointer movement, clicking patterns and scrolling. These signals help assess continuity between an enrolled person’s behavior and activity later in a session. The system evaluates movement rather than the content of what someone types or sees.
A Brainprint gives evidence that the expected person remains in control; it does not independently establish identity, intent or permission. GrayPass combines that evidence with other context and the application’s policies to determine whether an action should proceed, require fresh verification, be held or be denied.
The distinction between control and authorization becomes particularly important when users delegate tasks to AI agents. Someone may legitimately sign in, then hand a task to an agent to book travel, pay invoices or change settings. The account remains the same, but the actor carrying out the task has changed.
“The account can stay the same while the actor changes,” Mathur said. “If a user delegates a task to an AI agent, the application still needs to check whether that agent is authorized to take the specific action, or whether the agent is authorized at all.”
As agents take on more tasks inside business applications, GrayPass focuses on the point at which their actions could move money, change access or expose sensitive information. Its approach separates evidence of human continuity from the question of whether a particular action is authorized.
Adding Assurance Without Replacing Existing Controls
GrayPass works alongside identity providers, passkeys and multifactor authentication rather than replacing them. Teams choose which actions require a check and how their applications should respond to the result.
The service is designed for workflows where a single action can carry significant consequences, including financial platforms, business software and developer tools. Integration takes place before a protected action executes. For an allowed action in enforce mode, GrayPass returns short-lived, signed proof tied to that specific action and application.
To learn more, visit https://www.graypass.org/.
About GrayPass
GrayPass builds post-login assurance for applications that handle money, permissions and sensitive data. Its Brainprint technology combines behavioral continuity evidence with identity, device, session and transaction context to help applications assess whether the expected person is still in control before a sensitive action executes. The company is based in San Francisco and is part of Y Combinator’s Fall 2026 batch.
GrayPass was founded by CEO Arav Mathur, 19, and COO Aditya Ranjan, 18, who met on their first day of high school in 2021. Mathur has built and launched monetized software products since age seven and has worked in AI, machine learning and growth engineering at Stan, BenchSci, Aview International and the University of Toronto. Ranjan’s background includes computational work on seizure-node architecture and neurosurgical research, informing the company’s approach to human behavior and cognitive biometrics. GrayPass and its CEO have been featured in Forbes.
Contact Info:
Name: Arav Mathur/Aditya Ranjan
Email: Send Email
Organization: GrayPass
Website: https://www.graypass.org/
Release ID: 89206955
Google
RSS