Each guide explains one access security concept in neutral terms: what it is, what problem it solves, and where it sits in an access architecture. The first two cover privileged access management (PAM), the controls around accounts that can read or change production systems, and just-in-time access, which grants that access only for the task that needs it. Both apply least privilege to engineers and AI agents alike.

Formal applies these concepts in two products that share one control plane:

  • Formal PAM: just-in-time access to databases, SSH and Kubernetes through the Connector, a reverse proxy in your VPC, with short-lived credentials, session recording and no standing privileges.
  • Formal Endpoint: a forward proxy on laptops, VMs and Kubernetes that terminates TLS to inspect outbound traffic from workstations and agent sandboxes.
  • The platform: policies, identity and audit logs for both, with Catalog for resource discovery and Workflows for access approvals.