Keycard puts users, developers and companies in control of AI agents with real-time, adaptive permissions and complete transparency.
Joined December 2024
- Tweets286
- Following43
- Followers4.7K
- Likes161
"At the end of the day, if we don't have intent or some capacity to relay what is a user or the business' intent we actually can't get to autonomy."
Our CEO, @ianlivingstone, shared how runtime auth based on intent unlocks new levels of autonomy at @aiDotEngineer NYC.
Keycard made the 2027 Fortune Cyber 60.
@lightspeedvp's CISO survey found only a third of companies give agents their own scoped identities, and a quarter of them hand them human credentials.
Agents need their own identities, scoped to the task.
Full list in the reply.
"The trick for anyone building these systems is how do I ensure that I don't bring the user into the loop except when absolutely required"
@ianlivingstone explained how intent can help combat consent fatigue during our Intent Based Auth panel at AI Engineer NYC.
We're having fun talking to everyone at AGNTCon this week about runtime auth for agents.
We led a debate on if security is ready for a headless future and gave a talk on how to give agents autonomy, capability, and security.
Today is our last day, come say hi and see a demo!
It was great to see so many folks interested in agentic runtime security yesterday at AARM Intercept Night.
@jaredhanson @jankytweet @DickHardt gave a panel on Intent Based Auth
and @filearts demo'd intent based auth in Keycard!
To learn more about intent based auth watch our full panel from @aiDotEngineer NYC
youtube.com/watch?v=IavxrdVn…
Your best coding agent lives on one developer’s laptop. A software factory is when the whole team can share and learn from it.
Here’s how to get there: keycard.ai/blog/from-agent-s…
Read more about the Secure Software Factory reference architecture, in partnership with @Docker, @SocketSecurity, and others as part of Agent Baseline: agentbaseline.org/reference-…
Our panel on Intent Based Auth @aiDotEngineer NYC is LIVE on YouTube
@ianlivingstone CEO Keycard, Michael Davis Global Chief Security Architect @jpmorgan, and @DickHardt Founder of AAuth discuss why we must have runtime auth for agents based on intent.
What an amazing week! We spent the first half @aiDotEngineer NYC and the second half in SF for @AISecSummit and AAuth Night.
We enjoyed meeting all of you and talking about runtime auth for agents, intent-based auth, and the new software factory reference architecture.
Read the Software Factory Reference Architecture
teapawt.net/ianlivingstone/status/…
Today we're publishing the first draft of the Agent Baseline Software Factory Reference Architecture!
An opinionated blueprint for securing increasingly autonomous software factories, built with folks across the community.
It's open for feedback and contributions!
agentbaseline.org/reference-…
An agent's access for a task should be the overlap of what it can do and what the task needs, all inside what the org allows. More on how that works below.
We've spent a lot of time at @KeycardAI thinking about how authentication and authorization need to evolve as agents take on more work.
API keys and OAuth scopes were never designed to account for tasks, delegation between agents, or agents acting on their own.
I wrote about how we're approaching this and what we think needs to change.
keycard.ai/blog/defining-aut…
Then access is enforced as the work happens: short-lived credentials per task, denied by default, and escalated only when policy allows. Task done, access gone.
That context has to come from the trigger and the handoff chain, never from the agent's own description of its task. Otherwise an agent can talk its way into more access.