lanyard is an access broker: it grants just-in-time, least-privilege access to a resource for as long as it's needed, then revokes it on expiry — working through each provider's own API, never in your connection path. Agentless, audited, self-hosted.
lanyard is a broker, not a proxy — it grants and revokes native access through provider APIs and is never in the connection path.
Standing access is the real security problem. lanyard makes every grant temporary, least-privilege, and provable — without agents or a certificate authority.
No agents on your targets, no CA, nothing in the data path. One binary talks to each provider's own API.
A reconciliation loop drives reality toward “no grant outlives its expiry” — and records each sweep durably, so a stopped sweep is never mistaken for a clean one.
Every request, approval and revoke is an event answering who, what, when, where, why and how — on a tamper-evident hash chain you can verify.
Declarative rules auto-approve the routine. Anything else runs an ordered chain — levels are AND, the roles inside a level are OR — and a webhook tells the approvers, so nobody polls.
Vendor credentials are always referenced, never inlined. lanyard stores a pointer and resolves it at use — the secret never enters its config or its logs.
Every provider is an adapter behind one small port — four methods, proven against a conformance kit. If it has an API, lanyard can broker it.
They secure different layers, and they compose — already running a proxy? lanyard doesn't replace it; it governs whether the session should open at all, and for how long.
Provider credentials stay in the secret manager you already run. lanyard keeps a reference, resolves it at the moment of use, and drops the value when the call returns — never written to its database, never logged. Breach lanyard's store and you hold addresses, not keys. And your users' credentials are further away still: lanyard grants native access and never sees them at all.
Request, approve and revoke from the terminal — or wire lanyard into your own tools over plain HTTP. Every entitlement is four segments, provider:instance:resource:capability, so a broker fronting two orgs can never resolve a grant ambiguously.
You run the binary and own your data — no metering, no lock-in. The core is free forever, and security is never an upsell: approvals, audit and auto-revoke are in every tier, starting at $0.
lanyard is pre-1.0 and the paid tiers are not on sale yet — the prices above are the plan, not a checkout. The core stays free, and price changes will be announced at least 3 months ahead.
Self-host the whole broker — agentless, audited, and yours to run.