For most of enterprise AI’s short history, the risk ended with the answer. A chatbot could summarise a document, draft an email or suggest a next step, but a person still decided what happened afterward. AI agents change that bargain. Once software can update a CRM, query a financial system, call internal tools or trigger business workflows, intelligence is no longer the only question. Permission becomes part of the product.
Patrick Eden, co-founder and CEO of Palma.ai, captures the shift neatly: “Every company is about to give AI agents the keys to its systems. The question is whether anyone is watching the door.”
Palma has now raised $1.8 million in pre-seed funding, led by D11Z with participation from Plug and Play Ventures, Deel, Scale Now Ventures and angel investors including executives from Cisco and Deel. Instead of building another agent, Palma is building the infrastructure that sits between agents and the enterprise systems they want to use, enforcing permissions, policies and approvals while recording what happened afterward.
Palma was built by people who had already lived with infrastructure risk
The company’s origin becomes clearer through its founders. Eden previously co-founded an infrastructure-monitoring company serving Fortune 100 customers before its acquisition by Cisco in 2021. CTO and co-founder Julian Kolbe spent more than a decade building secure systems across fintech and automotive environments, including financial platforms processing billions in transaction value.
That background explains why Palma does not treat enterprise agents primarily as a better chat interface. The moment an agent receives real access, it becomes an infrastructure problem: who is acting, what they can reach, what they are attempting to do and who is accountable when the action crosses a boundary.
MCP opens the door. Palma decides what happens after it opens.
The Model Context Protocol (MCP) gives AI applications a standard way to connect with tools and company systems. Eden describes MCP as “profoundly enabling” organisations to scale investments they have already made in AI.
But connectivity does not answer the harder governance question.
Palma places a governed gateway between an agent and its MCP servers. A company can give each person or agent a controlled connector containing only the tools and capabilities they are entitled to use. Policies can then operate on the actual arguments of a tool call, while higher-risk actions can be paused for a named human approver.
That allows an enterprise to move beyond “Can this agent access this tool?” to something more precise: “Can this agent perform this particular action, using these parameters, for this employee?”
Every call can also carry the identities of the human user, the agent acting for them and the host application, alongside the tool, server and outcome. Denials and rate-limit stops are captured alongside successful actions, creating a record designed to make sense to security and governance teams rather than leaving them with an anonymous agent log.
Skills turn company know-how into something an agent can reuse
Access control is only half the problem. An agent may have permission to perform an action without knowing how that particular organisation expects the job to be done.
Palma calls its answer Skills.
A tool might let an agent create a support ticket. A Skill can carry the company’s playbook for when to create it, where it belongs, how it should be labelled and when it should be escalated.
Palma allows domain experts to capture those workflows before distributing them to entitled agents. Skills are scanned for secrets and patterns associated with prompt injection, data exfiltration and privilege escalation. Published versions become immutable snapshots, and a version that fails its safety checks is not served to agents.
That gives Palma an interesting second role. It is not only controlling what AI agents can touch; it is trying to convert institutional knowledge from experienced employees into governed operating instructions that many agents can reuse.
| Tool | Skill |
|---|---|
| Gives an agent a capability | Gives it the organisation’s process |
| “Issue refund” | When, how much and when approval is required |
| “Create incident” | Severity, naming and escalation procedure |
| Answers what can I do? | Answers how should we do it here? |
The governance layer is designed to survive changes in models
Enterprise AI is moving too quickly for companies to rebuild permissions every time employees switch assistants.
Palma therefore puts governance around the agent-to-tool boundary rather than a particular model. Its own material describes the same permissions, Skills and audit controls following users across different AI clients, while access can be assigned through existing identity systems such as Entra or Okta.
The same philosophy extends to deployment. Palma documents support for infrastructure running through Docker, Kubernetes or bare metal inside an organisation’s own network, with sovereign configurations designed without shared tenancy. Its safety classifiers for functions such as PII and prompt-injection inspection can also be self-hosted.
For regulated organisations, that changes the value proposition. The question becomes less about choosing the smartest model and more about whether the rules surrounding that model remain intact when the technology underneath it changes.
The next enterprise AI problem may be economics
Agents can also fail expensively.
A looping workflow, unnecessary tool calls or repeated retries still consume resources even when they do not produce useful work. Palma’s product material therefore connects governance with usage visibility, failures, token consumption and agent economics, while its broader FinOps direction aims to make costs understandable as agent adoption spreads across organisations.
That introduces another useful way to evaluate enterprise agents: not simply cost per token, but eventually cost per completed business task.
It is also where Palma’s governance thesis becomes broader than security. If the same control layer knows who initiated a workflow, which agent executed it, which tools were used and whether the action succeeded, it has much richer context for explaining both risk and cost.
The $1.8M round finances a much larger test
Palma will use its pre-seed financing to expand engineering and go-to-market as more companies move from AI pilots toward agents capable of performing real work.
The difficult part begins when those enterprises decide their agents are trustworthy enough to receive meaningful permissions.
If AI remains primarily a layer for drafting and recommendation, agent governance may stay relatively narrow. But if agents routinely modify records, access sensitive systems and coordinate workflows across departments, every enterprise will eventually need answers to questions that barely existed in the chatbot era:
Who authorised this agent? What exactly was it allowed to do? Which system did it touch? Was human approval required? And can the company prove what happened afterward?
Palma is betting those questions become infrastructure.
And if that bet is right, one of the most important products in the agent economy may not be another agent at all. It may be the layer that decides when every other agent is allowed to act.
