How to Share an Account With Your Agent and Know What It Did
2026-09-15
TL;DR Last year, we made the case for Checkpoint: a paradigm shift from traditional password managers for sharing online accounts. This post builds on this idea with a working MVP that we built in one week during an internal hackathon.
You gave your agent access to your X account and asked it to read your DMs and summarize them for you. How do you know the agent actually read all your DMs, and how do you know the agent didn't do something else like reply to posts or even make its own posts?
We've come a long way giving agents more and more access to our lives, but there are infinite examples like the one above where there's no simple, off the shelf solution. Password managers handle authentication but don't handle authorization. In other words, they don't deal with what happens once you're logged into an account. OAuth and MCP can do some of this work, but they require cooperation from the end website. Do you really think your regional bank is building an OAuth integration or an MCP server?
The internet is a world of a billion edge cases, and the only way agents can truly gain mainstream adoption is if they're able to handle every single one of these edge cases accurately, securely and with a verifiable paper trail.
Introducing Checkpoint
Last month we did an internal hackathon for one week with the goal of building a quarter's worth of our technical roadmap. We identified this problem, how to reliably give an agent scoped access to an account, as the highest impact problem our tech stack is uniquely suited to solve. In that week, we got a working MVP that we're calling Checkpoint. If you're interested in learning more about how we conducted this internal hackathon, check out Vivek's reflection here.
Here's how Checkpoint works, using X as the example:
Video: Checkpoint gives an agent scoped access to an X account.
Checkpoint is powered by our authorization and auditing engines: Warden, which enforces your policies, and Sentinel, which records what happened in natural language. Both run inside a Trusted Execution Environment. That means sensitive data like your login credentials are not retrievable by anyone (including us) and the enforcement as well as audit logs are produced by code that anyone can verify.
The Magic (of a) Link
Making the output of Checkpoint a shareable hyperlink was a deliberate design choice. Hyperlinks are the most fundamental primitive of the internet. Everyone (and everything) can open a hyperlink, which means you don't have to teach them how to use Checkpoint. Just give them a checkpoint link and tell them what you want done, that's it! Whether the recipient is Claude Code, ChatGPT or even a personal AI assistant like Instinct, checkpoint works out of the box with all of them.
Why hasn't this been done before?
Making something like Checkpoint work reliably requires juggling multiple unpredictable behaviors that are inherent to the internet.
Checkpoint enforces your policies at the network layer. While a button can be hidden, faked or re-enabled, a network request is a great source of truth: it's what actually changes your account's state. So building Checkpoint at this layer of the stack was a deliberate security choice, but working at the network layer means solving three hard problems.
- Finding the signal in the noise. Websites are really messy. Don't believe me? Go to a website you visit often and open the Network tab in your browser's developer tools. You'll see hundreds, maybe even thousands, of requests. Some go to the site itself, some go to third-party services like Google Analytics, and some come from your browser extensions. To know which network requests were actually caused by a UX action requires intelligent filtering.
- Mapping every action ahead of time. Before we offer a website on Checkpoint, we need to map every action you can take on it and learn exactly what each one looks like on the network. We do this work ahead of time so Checkpoint can enforce your policy in real time with ~zero latency. Finding every possible action for a website (and accurately) is an extremely time consuming task that off the shelf computer use agents have not solved. And even if you can map every action, making intelligent decisions about how actions relate to each other is another can of worms. On Reddit, is replying to a post the same action as replying to a comment? It depends on whether anyone would ever want to allow one but not the other. Now multiply that decision across every button on every site.
- Keeping up with change. Even if we solved the first two problems perfectly, websites change ALL THE TIME. A new feature, a redesign or a renamed request can put part of the map out of date overnight, so we need a way to detect those changes and update the map quickly.
This is the tip of the iceberg, but hopefully we've made the point: making Checkpoint work reliably and at scale is a very difficult engineering problem, but if we can make it work it has massive implications for how we interact with agents in the future.
What's Next
Now that we have an MVP, we're doing another 1 week hackathon (Lock-In Part 2!) to make Checkpoint ready for production so we can roll it out at the end of the month. If you're interested in trying it out, get in touch with us!
We're redefining zero-trust — so you can protect your accounts with confidence.
Identity is your first and last line of defense, and the root cause of most application security breaches. Multifactor's provably secure zero-trust solutions cryptographically guarantee that only authorized users can access sensitive data, turning identity into your greatest asset in the fight against cyber threats. Learn more about our research, or reach out to explore working together.
Related Posts
Introducing Checkpoint: A Better Way to Share Online Accounts
2025-07-07
Checkpoint uses novel cryptographic techniques to enable easy revocable, non-repudiable, and fine-grained sharing of any online account resource.
Introducing Portal: Multifactor's API Gateway Solution
2025-05-28
Today, we're excited to announce the release of Portal, Multifactor's brand new serverless, globally-distributed API gateway, available now in early access.
How I Built a Twenty-Agent Fleet on One Desktop
2026-09-09
A tool that runs twenty AI coding sessions in parallel, one ticket each, with real before-and-after screenshots. Five rebuilds to get there, and nearly every bug along the way was something reporting success while failing.