Cerby Agents

Last Update: July 27, 2026

The part of Cerby that reaches into the applications your identity provider can't, doing the account and access work your team would otherwise do by hand, to the same standard, every time.

Why is a Cerby agent?

A Cerby agent is automated software that performs identity and access management tasks inside an application on your behalf.

Think of the work a careful admin does by hand: logging in to an app, finding the right user, and making the change correctly, then confirming the intended change sticks. A Cerby agent does that same work, precisely and consistently, every time it's asked to.

You'll find agents behind the scenes anywhere Cerby manages an application that wasn't built to connect to a modern identity platform: adding a new hire to a marketing tool, rotating a shared password on schedule, onboarding a passkey for a service account, or cutting off access the moment someone leaves your team.

Why Cerby uses agents

Most identity platforms only reach applications that speak their language: SSO, SCIM, and a proper admin API. In practice, most companies run on dozens of applications that were never built with those standards in mind: corporate social accounts, niche vendor tools, the finance stack, and the long-tail apps your teams depend on every day, whether or not procurement signed off on them.

Cerby agents close that gap. They extend the same governance, visibility, and control you already expect from your identity provider to every application your business actually uses, not just the ones that make it easy.

What Cerby agents do

  • Provisioning: Add a user's access to an app the moment it's approved. No manual setup, no waiting.
  • Deprovisioning: Remove access the moment someone leaves a role or the company, closing the window that attackers look for.
  • Password rotation: Rotate shared credentials on a schedule or on demand, without anyone ever needing to know the password.
  • MFA management: Turn on multi-factor authentication for an account and confirm it stays correctly configured over time.
  • Entitlements sync: Keep roles and entitlements up to date as your team, org chart, and vendor relationships change.
  • Universal logout: End every active session for a user across managed apps the instant access needs to stop.

How Cerby keeps this safe

Automation only earns trust if you can see exactly what it did and why. That's the standard every Cerby agent is held to.

  • Every action is logged. Each task an agent performs is recorded in your Automation Log, including what ran, what triggered it, and what changed, so nothing happens in the dark.
  • Scoped to the task. An agent only uses the access assigned to the specific task in front of it, never broader account privileges than the job requires.
  • Traceable by design. Every change an agent makes traces back to its source, so audits and incident reviews start with an answer, not a search.

What you can see and control

The Automation Log in your Cerby workspace is the record of everything your agents have done: the status of each task, the app it touched, what triggered it, and when. Workspace Owners, Super Admins, and Admins see every job across the workspace; Users see the jobs tied to the accounts and business hubs they own.