GrayPass checks, before a payment, permission change, or customer-data export, whether the expected person is still in control of the session and whether an AI agent acting through it is authorized for that action. Product and security teams add it beside the login, passkeys, and MFA they already run. Those checks establish who entered. GrayPass is invoked when the action is about to run, since a session opened hours earlier does not show whether the original person, a delegated agent, or someone else is about to move money or pull data. The check combines identity, device, and session context with behavioral signals GrayPass calls a Brainprint. That evidence covers keystroke timing, pointer movement and clicks, and scrolling patterns such as speed, pauses, and changes in direction. It describes how someone interacts, not the words they type. The application's own policy sets what is required. GrayPass returns allow, challenge, hold, or deny, and the application enforces the result before the action executes. An allowed action can carry short-lived signed proof bound to that specific action and app. GrayPass is in Y Combinator's Fall 2026 batch, founded by CEO Arav Mathur and COO Aditya Ranjan. By the launch, it had processed more than 900,000 sessions across customer apps and generated $50,000 in revenue that month.