One startup, two buyers, two very different prices.
Since 2019, Oso has sold a simple idea: stop hand-building permission systems. Let a service decide what each user can see and do. This week it split in two. Temporal hired the team. Tiny, a Canadian holding company, bought the product.
The product price. Tiny says it closed on the Oso Cloud assets on October 1 for about $1.9M: roughly $1.2M in cash at closing plus a ~$0.7M holdback for transition services and adjustments. At close, Oso Cloud had about $5.3M of ARR across roughly 80 customers in security, fintech and developer software, all on subscription, several on multi-year deals (per Tiny). Tiny converted Oso’s US-dollar ARR at a 1.42 spot rate. On Tiny’s own figures, that’s about 0.36x ARR. Read the price in US dollars against the unconverted ARR, roughly $3.8M, and you still get about half a turn.
Either way it’s under 1x. For recurring software revenue that sells into security buyers, that’s a cash-flow price. Tiny describes itself as buying businesses with strong free cash flow and holding them for the long term. It paid like it.
The people price. Temporal raised $550M last month at a $12.55B valuation and recently passed $250M of annualized revenue run rate, growing more than 200% year over year (per GeekWire). That’s about 50x run rate. Terms for the Oso team: Undisclosed.
Put the two numbers side by side. The authorization product got roughly a third of a turn. The runtime it’s moving into trades near 50x. That gap is the story.
Our POV. Standalone authorization was a feature waiting for a home. For human users, it lived happily as a library or an API you called. Agents change where the decision has to happen. An agent runs a multi-step job, fails, retries and resumes. Permissions and human approvals have to survive all of that. Temporal’s VP of product Preeti Somal put the goal plainly: for each action an agent takes, ask “who it is acting for and what that person is allowed to do,” and get the same answer every time the work is retried (per GeekWire).
That’s a runtime problem. Durable execution already holds the state and the history. Put the policy check there and you avoid the classic agent failure: a rejected action that quietly comes back on retry. Oso founder Graham Neray said Temporal already powers agents inside Cursor and OpenAI Codex. If that’s where the actions run, that’s where the authorization belongs.
The TAM check. In 2023, Neray told TechCrunch authorization was “a $25 billion market,” the day Oso announced a $15M round led by Felicis that put total funding over $25M. That’s the CEO’s number, not ours. But it’s a useful test. If the category leader’s product clears for about $1.9M, the market wasn’t $25B of standalone software. It was $25B of engineering time that platforms now absorb.
Who should read this as a warning. Point vendors in permissions, NHI and agent access that don’t sit in the execution path. Acquirers will pay for engineers who understand authorization. They won’t pay growth multiples for a policy engine that sits beside the workflow. Expect more acqui-hires with product carve-outs, and more holding companies happy to collect the renewals.
If you run Oso Cloud. Your vendor is now a TSX-listed holding company, and the original engineers work at Temporal. Get roadmap, SLA and support commitments from Tiny in writing before your next renewal. The holdback covers transition services, so ask what happens when that window ends. Ask who now owns security fixes and the incident response contact.
For analysts. Watch the spread. Infrastructure that owns the agent runtime is being priced on growth. Security features that plug into it are being priced on cash flow. Oso is the cleanest data point yet that the market can tell the difference.