Shashwat Sehgal and the Trouble with Keeping the Keys

Shashwat Sehgal teaches his son chess. In his working life, he spends rather more time thinking about what happens when every piece is allowed to move everywhere. A developer needs a database. A service needs another service. An AI agent needs permission to do something useful. Each request makes sense in isolation. Add them together, leave the permissions in place, and the board becomes difficult to read.

Sehgal is the co-founder and CEO of P0 Security, a company he started with Gergely Danyi and Nathan Brahms in 2022. Its central concern is access: who has it, what it permits, and when it should end. This is a modest-sounding subject with a habit of becoming everybody’s problem at an inconvenient hour.

His route into it ran through financial engineering, consulting, networking and software observability. Along the way, he worked on products that helped engineers understand complex systems. Eventually, he began asking why those same engineers had to spend so much time negotiating permission to work on them.

The view from the troubleshooting desk

Before there was P0, there was a career spent moving between technical work and business decisions. Sehgal studied computer science and engineering at IIT Delhi and earned an MBA at Columbia Business School. His earlier roles included engineering and quantitative trading at Merrill Lynch, followed by strategy consulting at Booz & Company.

At Cisco Meraki, where he worked from 2016 to 2020, he led work on SD-WAN and Meraki Insight. The latter helped teams investigate application performance across their networks. If an application was slow, the useful question was where the delay began. A complaint about the internet could conceal several quite different failures.

In June 2019, Sehgal and colleague Neeraj Periwal wrote about a Google Calendar outage and how Meraki’s own IT team used Insight to investigate. Employees were losing access to their calendars; the team could identify the problem quickly. The episode puts a practical frame around his product work: people wanted to get on with their day, and somebody had to untangle the machinery.

He joined Splunk in 2020, working on real user monitoring within its observability business. By December 2021, he was presenting with Mat Ball on tracing transactions from a person’s web browser through the backend services supporting it. The ambition was to make a sprawling application understandable from end to end.

That work also left a technical record. Sehgal is among the named inventors on a Splunk patent for rendering a service graph to illustrate page-provider dependencies, granted in July 2023. A service graph makes relationships visible. Later, at P0, relationships between identities and resources would become the thing to examine.

A permission problem in plain sight

At Splunk, Sehgal met Danyi, who would become P0’s co-founder and CTO. In a 2023 interview, he described watching acquired businesses bring modern applications into the organization: Kubernetes, microservices, and infrastructure running across AWS and Google Cloud. Each brought its own complicated web of permissions.

Security teams wanted guardrails. Engineering teams wanted to build and operate software. Both had reasonable demands. The difficulty was getting those demands to coexist without turning access into a recurring administrative negotiation. A control that arrived as another obstacle could produce precisely the friction its designers hoped to remove.

Sehgal’s conclusion was direct: “there has to be a better way to solve this”. P0’s founding team combined his product experience with Danyi’s engineering background and Brahms’s experience across companies including Cisco Meraki and Semgrep. The company’s starting point was a problem its founders had encountered while building other things.

Consider the ordinary request that Sehgal used to explain P0’s launch: an engineer troubleshooting a customer issue needs access to a production datastore. Perhaps it contains customer data. Perhaps the task involves a Kubernetes namespace instead. The work may be legitimate and urgent. The permission still needs an owner, a scope and an ending.

P0 set out to automate that lifecycle. An engineer should be able to request the access needed for a particular job, receive an appropriate grant, and lose it when the authorized period ends. The security team should be able to see the arrangement. Getting the work done and knowing who can do it belong in the same conversation.

A year of building, then three minutes

P0 announced its general availability and $5 million in seed funding in November 2023. Lightspeed Venture Partners and SV Angel were among its backers. For a founder, a launch makes a convenient date to circle. Sehgal’s account of the preceding work gives the circle some substance.

He described recruiting the team, finding early adopters and building through the months before release. General availability was the culmination of that work. Afterward came more customer conversations and further product development. There was no suggestion that putting the product in public had completed the difficult part.

In April 2024, P0 was named one of ten finalists for the RSA Conference Innovation Sandbox. On May 6, Sehgal pitched the company at the contest. Finalists had three minutes to explain their products before questions from the judges. Cloud identity governance is not a subject that naturally observes a three-minute limit.

The appearance gave an unusually compact public expression to a company built around reducing complexity. A founder has to make the problem legible before anyone can care about the mechanism. Sehgal’s version kept returning to a question that an engineer and a business leader could both recognize: who or what can reach the cloud?

In September 2024, P0 announced a $15 million Series A, taking its disclosed funding to $20 million. SYN Ventures led the round, with Zscaler and Lightspeed participating. SYN operating partner Ryan Permeh joined the board. The company said it would expand engineering and its go-to-market team. More money meant more capacity to build, sell and support the approach.

The new colleague has no desk

As AI agents moved into production systems, Sehgal’s access question acquired another subject. An agent can call tools, retrieve information and trigger workflows. Its usefulness depends partly on what it is allowed to do. That makes permission an operating concern before it becomes a forensic one.

In his 2026 discussions of privileged access, Sehgal argued for temporary, narrowly scoped authorization for humans, machines and agents. An agent releasing a build, for example, should receive authority for that action rather than permanently hold a broad deployment role.

“Permissions should exist only for the exact scope and time needed”

Shashwat Sehgal / on temporary access

His September 2026 writing pursued a related complication: agents operate within systems of authority that humans have already created. A centrally managed agent, a user-connected assistant and an agent invoked through background automation may inherit very different permissions. Treating them as interchangeable can conceal the very access paths a company needs to understand.

His example involved a person entitled to see only some customer records asking an agent for help. The agent might itself have access to a much larger dataset. Looking at either identity separately could miss what their combination permits. Sehgal’s concern is the authority assembled along the way, including the people, services and tools involved.

This extends the problem he encountered before founding P0. More capable software brings more routes into sensitive systems. His answer keeps the authorization decision close to the action, with enough context to explain why it was allowed. The argument has continuity even as the cast of actors grows.

The spreadsheet does not get to decide

Sehgal has also written about a different kind of permission: the authority to make a hiring decision. In February 2026, he criticized early-stage companies that import elaborate interview loops and weighted scorecards before they have a clear view of what a role requires.

His objection was specific. A team with limited management capacity and shifting priorities needs to choose the few attributes that matter now. A complicated rubric can delay that choice while making uncertain judgments look mathematically settled. Numbers have excellent manners; they can make a guess look as though it arrived wearing a tie.

He allowed that structure becomes valuable as an organization grows and more people need to make consistent decisions. Timing matters. For a young company, his advice was to articulate the tradeoffs and commit. Read beside his access work, the essay suggests a shared practical preference: a process should earn its place by helping people act.

A game with rules, and time to play it

Outside work, Sehgal enjoys tennis, reading historical narratives and autobiographies, and spending time with his family. His public biography includes teaching his son chess. In a 2024 conversation, he also admitted he had yet to try pickleball because the courts were always booked. Even recreation, it seems, has an access problem.

Those details give scale to a career otherwise described in platforms and permissions. There is a parent explaining a game, a reader interested in other people’s lives, a player looking for a court. None requires a grand theory of entrepreneurship. They are ordinary activities that make the person easier to recognize.

At P0, the stated ambition remains to help organizations secure access while letting engineering teams move. It asks for considerable machinery underneath a comparatively simple experience. Someone has a task. Someone grants the necessary authority. The task finishes. The authority ends. For Sehgal, that last move deserves as much attention as the first.