Why we built BotAris

AI agents are no longer just answering questions. They approve transactions, update records, call other systems, and hand work to other agents. Every one of those actions is a decision, and most organizations have no way to state which decisions an agent is allowed to make.

The tools we have were not built for this. Identity and access management answers three questions: who is this, does it have valid credentials, and does it have the right permissions? Those answers still matter. But an agent with valid credentials and the right permissions can still make a decision nobody authorized. Access tells you an agent can reach the payments system. It does not tell you whether that agent should approve a payment of that size, on its own, right now. It also does not tell you whether that payment, added to what other agents have already approved today, stays inside the limit the business set. Individually permitted actions can collectively produce unauthorized outcomes.

The common response is to find every agent first and then govern each one individually. We do not think that model holds up. Agents can create other agents, and some may exist for only seconds. If governance depends on discovering every agent, registering it, and assigning the right permissions, then any agent you have not discovered sits outside the governance model. And even the agents you do know about are governed only at the level of access. Permissions, including deny rules, say which systems an agent can or cannot reach. They do not say which decisions the business never intended it to make.

So, we started from a different place. BotAris governs the action at the moment of decision, not the agent's registration. Known or unknown, every agent's actions face the same test: is this within the authority that was granted, and who granted it?

We call this authority governance. BotAris is the authority control plane for agentic AI. It lets organizations define what their agents are authorized to decide, enforce that authority at runtime, and keep an accountable record of every decision. Each action resolves to one of four outcomes: allow, constrain, escalate to a human, or deny.

Our mission

To let businesses innovate with AI agents by making every decision those agents make governed and accountable.

We give AI agents a mandate, not just a credential, and check every decision they make against it at runtime.

Our founder

Jonathan Edwards

Founder & CEO

Jonathan has spent nearly two decades in identity and access management, working across directory services, federation, privileged access management, identity governance, and non-human identity. His leadership roles have included CEO of the Americas for iC Consult and Managing Director at KeyData Cyber.

In 2018, Jonathan argued that customer identity should be viewed not only as a security control, but as a driver of revenue through customer acquisition, experience, and retention. That business-enablement mindset has since become a common part of how the industry approaches CIAM. Today, he is challenging another long-held assumption in identity: that controlling access is enough to govern autonomous systems. As AI agents become capable of making decisions and taking action on behalf of organizations, Jonathan believes the industry must evolve from governing who or what has access to governing the authority behind the decisions being made.

As AI agents moved from assistants to actors, Jonathan saw a gap in the identity model he had worked within for most of his career. Identity could tell an organization who an agent was and what it could access. It could not tell the organization what that agent was authorized to decide. In 2026, he stepped away from traditional IAM practice to found BotAris, built on the belief that identity remains essential but is no longer sufficient for governing autonomous AI.

Jonathan's LinkedInBotAris LinkedIn

Leadership

KJ Gambhir

CSMO

KJ is Co-Founder and Chief Sales and Marketing Officer at BotAris. He brings over a decade of cybersecurity experience, including leadership roles at ArmorCode, Apiiro and Immersive Labs, with expertise in growth strategy and strategic partnerships.

LinkedIn

Additional Board of Directors

Ken Stone

Ken Stone is a cybersecurity executive and former CEO of SecureITsource, acquired by iC Consult in 2022. With two successful company exits, he brings experience building businesses from the ground up through acquisition, alongside deep expertise in identity and access management.

LinkedIn

Advisors

David Lee

David Lee, known as “The Identity Jedi,” is Field CTO at Saviynt and an identity security expert with over two decades of experience. He brings expertise in enterprise identity and access management, consulting and product strategy, helping organizations strengthen their approach to identity security.

LinkedIn

Kyle Weckman

Kyle Weckman is Chief Information Security Officer at Antares Capital, with prior leadership experience at Kestra Financial, OCC, Accenture and Deloitte. He brings expertise in enterprise cybersecurity, identity security and risk management across financial services.

LinkedIn

Drew Christman

Drew Christman is Founder, Senior Partner and CEO of Christman Attorneys, PLLC. With over 25 years of legal experience, he brings expertise in business law, complex litigation and strategic counsel, helping companies navigate formation, contracts and business disputes.

LinkedIn

Board Observers

Gunderson Dettmer Law Firm

Gunderson Dettmer is a global law firm advising startups, growth companies and venture capital investors. The firm supports businesses from formation and fundraising through acquisitions and public offerings, bringing deep experience in corporate governance and the venture ecosystem.

Website