Delinea launches Fastpath MCP Server for AI audits

Delinea has launched Fastpath MCP Server, a product that links access governance data with AI assistants.

The launch adds a new function to the company's Fastpath platform, which is used for application access governance across more than 100 connected systems, including SAP, Oracle, Workday, Salesforce and Microsoft Dynamics 365.

Fastpath MCP Server uses the Model Context Protocol, or MCP, to let finance, IT, audit and compliance teams ask natural-language questions about access risk, access reviews and audit readiness. Users can query live Fastpath data without moving it into another system, so responses reflect the current state of connected applications.

The tool is designed to address a common problem for organisations managing complex enterprise resource planning environments, where large volumes of segregation of duties conflicts can make remediation and audit preparation slow and labour-intensive.

Teams typically review spreadsheets and reconcile data manually when assessing who has access to what across multiple business systems. Fastpath MCP Server is intended to reduce that work by letting users ask direct questions such as whether an organisation is ready for an audit, which access reviews remain open, which reviewers have not completed tasks and which segregation of duties risks do not have mitigating controls.

The system provides visibility across both cloud and on-premises applications. It can return information on users, roles, controls and access reviews across multiple platforms at the same time.

Audit focus

The launch comes as companies examine the governance requirements behind wider AI adoption. As AI assistants connect to internal business systems, organisations face greater pressure to show that access decisions, risk monitoring and audit processes remain under control.

Delinea said Fastpath MCP Server is read-only and restricted by each user's permissions. That means a connected AI assistant can query information in Fastpath but cannot make changes in the system.

Fastpath has also been independently audited under SOC 1 Type 2 and SOC 2 Type 2 standards, Delinea said. Reports generated from the platform are used by audit and consulting firms to test IT general controls and access controls tied to financial reporting.

Jason Mitchell, EVP, Product & Technology at Delinea, said the product is intended to shorten the time between identifying an access issue and deciding what to do about it.

"Our customers spend too much of their time turning access data into decisions," Mitchell said. "Fastpath MCP Server gives that time back. Finance teams and business application owners can ask a question in their own words and get a clear, prioritised answer they can act on, grounded in the same data their auditors already rely on."

Delinea said the product includes more than 30 native connections that can surface risk at a detailed level within connected applications. Its segregation of duties and sensitive access rulesets are based on the COSO framework and ISACA remediation practices.

Customer use

Chromalox, a Delinea customer, said the product addresses a process that has often involved manual spreadsheet work and data lookups.

"Getting answers out of our access data used to mean building Excel lookups and stitching data points together by hand," said Neil Poynton, Director of ERP at Chromalox. "With Fastpath MCP Server, we'll be able to ask a question in plain language and pull together the information held in Delinea Fastpath in a fraction of the time. It's an exciting addition to our solution."

Delinea positions Fastpath as part of a broader identity security business that serves more than 9,000 organisations, including two-thirds of the Fortune 100. Within that portfolio, Fastpath focuses on governing access across business applications and automating controls linked to audit readiness, segregation of duties analysis and oversight of sensitive systems and data.

The new MCP Server extends that role by making governed access data available through AI assistants already used inside organisations, while keeping queries tied to existing permissions and audited source data.