Oren Ohayon Harel and the trouble with getting in

A bank can know exactly who you are and still have a surprisingly awkward time deciding what you may do. Oren Ohayon Harel encountered that difficulty from the security side of the desk at Bank Hapoalim. Employees and customers needed access to services. Requests and permissions did not always move together. Somewhere between a legitimate need and an approved action, the business had to wait.

That gap became the subject of his working life. Harel is now co-founder and CEO of PlainID, which builds software for authorization: deciding whether a particular identity can perform a particular action on a particular resource. It is a field with an unhelpfully long name for something everyone understands when the office door refuses to open.

The familiar login screen gets the attention. The permissions behind it have the longer shift.

The bank followed him out of the building

Harel’s route ran through technology service in the Israeli military, information security work at Bezeq and Taldor, and more than seven years at Bank Hapoalim beginning in 2007. He served as deputy chief information security officer. He later remembered the early PlainID team working with a few engineers in a small, old Tel Aviv apartment, spending its first three years on product development.

The professional connection mattered. Gal Helemski, his fellow co-founder, had worked as a security consultant at the bank. Both had seen the difficulty of managing access across enterprise systems. Their collaboration grew around a problem they had encountered in practice. A large organization could establish identities and still struggle to govern the work those identities performed.

PlainID dates its founding to 2014. Its eventual product would ask companies to treat access rules as something they could manage across systems, rather than repeatedly burying the decisions inside each application. For a founder coming from bank security, that meant trying to sell an answer to a problem he had previously been responsible for managing.

“I wanted to grow something from nothing.”Oren Ohayon Harel

A term sheet, a detour, a Monday meeting

Helemski’s recollection of their seed funding supplies an unusually concrete picture of Harel making a decision. The company was self-funded and money was running low. An offer arrived for more than they had expected. They celebrated with the team and traveled to Silicon Valley to complete the transaction.

Then Harel pushed to abandon it. Something about the arrangement felt wrong to them. They backed away and diverted to New York, where an alternative depended on a presentation to a major financial institution’s technology department. They prepared over the weekend. On Monday, they presented to 20 technology specialists on the building’s 43rd floor. A term sheet followed by the time they returned to Israel.

The episode makes the early company feel smaller than its later funding announcements. There was no comfortable abundance of options. There was an uncomfortable choice, followed by a weekend of preparation. Conviction still required a presentation good enough to survive a roomful of specialists.

The useful distinction behind the acronym

Harel’s subject becomes easier to follow if you imagine a business application after someone has signed in. The application knows the user’s identity. It still needs rules for the records that person may read, the fields they may change and the operations they may perform. Knowing a name leaves quite a lot of work unfinished.

PlainID’s policy-based approach places rules around those actions. The company describes centralized policy management alongside enforcement across different parts of a technology stack. The point is to give a business a way to express access decisions consistently, even when the applications and data are distributed.

A simple illustration helps. A person might be entitled to open a reporting application without being entitled to every report inside it. The permission to use the application and the permission to retrieve a particular dataset answer different questions. As organizations add services and interfaces, those questions multiply.

For Harel, the commercial challenge has included making that distinction matter to buyers. Authorization can sound like a feature already included somewhere else. A founder has to show where an organization’s existing arrangements stop being manageable, and why a separate policy layer earns its place.

SAP brought the idea into another company’s machinery

In April 2019, PlainID announced an OEM agreement with SAP. Its SmartAuthorization technology would feature in the SAP Customer Data Cloud portfolio. Harel described authorization as a source of frustration for companies attempting to build access-management decision systems themselves.

The agreement gives his story a useful change of scale. An enterprise software company must do more than persuade someone that a problem exists. Its product has to fit into the software, processes and commercial relationships already surrounding that problem. An OEM arrangement makes that requirement especially visible: another vendor incorporates the technology into its own offering.

For the customer, the policy still has to work inside an ordinary transaction. The partnership announcement may be a milestone for the supplier; the person trying to complete a task mostly wants the correct answer without an expedition through several administrative screens.

By July 2020, PlainID had also been named an EMA Top 3 vendor for group and user policy management. That recognition covered a field concerned with contextual access controls, management usability and onboarding. These are practical subjects. A permission system has to be understandable to the people charged with maintaining it.

The round was large. The job stayed detailed.

On December 21, 2021, PlainID announced a $75 million Series C led by Insight Partners, with participation from Itai Tsiddon, Viola Ventures and existing investors. The company put its total funding at $100 million. It said the money would support product development and expansion of its sales and market presence.

For a CEO, investment creates another set of choices. More capital allows more activity, but customers still buy specific capabilities. A data integration has to function. A policy change has to reach the right place. A growing team has to understand which work matters first.

PlainID’s account of 2022 reported annual recurring revenue growth above 50 percent and the launch of its Authorization-as-a-Service platform. It also described prebuilt Authorizers for areas including API gateways, microservices and data lakes. Each connected the central policy idea to a particular environment where an access decision had to happen.

By early 2024, the company said it served more than 100 global enterprise customers across 20 industries. Its plans included additional authorization capabilities for SaaS applications and a module called Identity Insights. The expanding product vocabulary reflected the range of places where the original access problem appeared.

Then the user acquired tools of its own

AI agents give Harel’s subject another audience. An agent can act on a person’s behalf, retrieve information and invoke tools. The identity associated with a request is therefore only the start of the decision. The permitted action, the resource and the circumstances still need attention.

PlainID’s current platform description applies its authorization model to human users, machine identities and agents. Its stated coverage includes prompts, data retrieval, tool use and outputs. Those are different stages of a workflow, which helps explain why a single permission granted at the beginning may leave consequential questions unanswered later.

Harel’s public priorities for 2026 emphasize authorization at scale and policies that can be governed throughout their lifecycle. He highlighted Policy 360°, describing visibility across authoring, approval, deployment and audit. Behind the product name sits a recognizable management concern: someone must be able to explain why a rule exists and what it does.

The practical questions can be wonderfully stubborn. Who approved the agent’s access? Does the permission apply to this operation? What should happen when the user’s circumstances change? An automated workflow can complete its task quickly while still leaving those questions for the people responsible for the system.

A closing conversation called Zero Access

Harel is listed for the closing fireside conversation at Agentic IAM Day on October 28, 2026, alongside news anchor and correspondent Natasha Raquel Kirtchuk. The session is titled Zero Access. Its stated subject is where identity and access management goes as companies try to govern agents.

It is an apt place to leave his story for now: a banking security practitioner discussing a new population of software users. The surroundings have changed considerably since the small Tel Aviv apartment. The question remains specific enough to put in front of any proposed action: should this identity be allowed to do this, here, now?

A business can celebrate a successful login. Harel has built his company around the decisions still waiting on the other side.