How Postman governs AI agent access to 42 production systems

Postman deployed its Passport access-management system to secure production API access for developers building and maintaining its agentOS fleet, which grew from 32 to 70 agents across go-to-market, product, and engineering functions. A security audit had identified 278 API keys spread across developer devices, CI configurations, and deployment manifests, including over-scoped vendor credentials and shared keys that complicated attribution and rotation. Passport replaces local secrets in environment files with references that are resolved at request time through a managed laptop daemon and corporate-network proxy, while real credentials remain in vaults. Security created a catalog limiting 42 SaaS and internal systems to 104 approved endpoints, enabling resource-level permissions, time-limited developer access, per-call attribution to developers, agents, and runs, and centralized revocation. The five-day rollout replaced existing environment credentials and rotated old keys, reportedly reducing production credentials on developer machines to zero while shortening new-system onboarding from 15 to three days and enabling new developers to contribute within two hours.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.