Software is beginning to act.

We have spent decades getting better at identity.

We built passwords.

All of it matters.

But knowing who an actor is does not tell you everything that actor should be allowed to do.

That distinction becomes more important when the actor is software.

Imagine an agent authenticates successfully to an MCP server.

We know exactly which agent it is.

Now it asks to:

repo.read · payments-api

Then:

repo.deploy · staging

Then:

database.delete · production

Should authentication answer all three?

I don’t think it should.

Identity tells us who the agent is.

Authority tells us what that agent may do.

Those are different questions.

The old software model was simple.

Humans decided.

Software executed.

Security systems were built around that relationship.

The machine was mostly the instrument.

Now the instrument is becoming an actor.

An agent can receive a goal and decide how to pursue it.

That changes the security problem.

Not because the old infrastructure suddenly became useless.

But they now sit inside a world they were not originally designed around:

software making consequential decisions at software speed.

That changes what we need to govern.

This is where I think the industry can make a dangerous mistake.

We can give an agent access to a system and assume the problem is mostly solved.

It isn’t.

Access answers whether the door can open.

Authority asks what should happen after the agent walks through it.

Consider an engineering agent.

It may legitimately need access to GitHub.

But “access to GitHub” is not one thing.

Those actions don’t carry the same consequence.

So why should they inherit the same authority simply because the actor authenticated successfully?

The problem isn’t that agents have capabilities.

We want capable agents.

The problem is allowing capability to become authority by accident.

Much of the conversation about AI safety starts with a difficult ambition:

How do we stop the model from being wrong?

We should keep working on that.

But I don’t think we should build the autonomous economy on the assumption that we’ll solve it completely.

Agents will make mistakes.

So I keep coming back to a simpler question:

Why did a mistaken agent have authority to do the damage in the first place?

That changes the problem.

We may never make autonomous software incapable of being wrong.

Human-oriented systems often think in relatively durable states.

An agent behaves differently.

One authenticated agent can attempt thousands of heterogeneous actions.

Each action can have a different consequence.

And those actions can arrive much faster than a human can supervise them.

So the question moves closer to execution.

Not only:

Who is this?

Not only:

What system can it access?

But:

That is the question we built Keydris around.

The idea is simple.

An agent intends to perform an action.

Before that governed action runs, its authority is evaluated.

For example:

Then:

Then:

Or perhaps:

The agent did not become a different agent between those requests.

Its identity did not need to change.

Its connection did not need to disappear.

The questions changed.

So the authority decision changed.

That is the boundary.

Authority before action.

This is one of the ideas I believe will matter most.

We are used to treating authentication and authority as if they move together.

But autonomous systems need those states to separate.

An agent can remain authenticated while the authority assigned to it changes.

The agent can still be the same agent.

The underlying system can still know who it is.

But the next governed action can receive a different answer.

That separation is the point.

This is where a security engineer should challenge me.

So why Keydris?

Good question.

We are not claiming those systems disappear.

We are not claiming authorization was invented in 2026.

And we are not claiming you couldn’t assemble pieces of this yourself.

You can.

The deeper question is whether autonomous software creates an authority problem important enough to deserve its own infrastructure.

We think it does.

Keydris is built around the operational question immediately before a governed agent action:

Does this machine have authority to do this?

Not in theory.

Not because its identity belongs to the right group.

Not because it received broad access earlier.

This action. This resource. This environment. Under the authority assigned to it now.

And if the answer changes, the agent’s authority can change without requiring the agent itself to become someone else.

That is the abstraction we are betting on.

I think infrastructure companies lose credibility when they pretend the primitives underneath them don’t exist.

So let me make the opposite argument.

You could build this yourself.

Then repeat some version of that architecture everywhere autonomous software acts.

You can do that.

Our bet is that eventually you won’t want to.

Because the thing being assembled isn’t merely another permission.

It is an authority system for autonomous actors.

That’s what we’re building.

This distinction matters.

We can tell an agent:

“Never touch production.”

Good.

We should.

But that is an instruction to an intelligent system.

It is not the same thing as an execution boundary refusing:

production.delete

Instructions influence behavior.

Authority limits behavior.

We need both.

The prompt can tell the agent what it should do.

The authority layer determines what it may do.

That means a prompt injection doesn’t need to make the entire system trustworthy.

But a governed action can still hit a boundary that says:

That is a different kind of safety.

I think this is one of the most important ideas in autonomous systems.

We spend enormous energy trying to increase the probability that an agent makes the correct decision.

We should.

But another lever exists.

Reduce the consequences when it doesn’t.

The goal isn’t perfect agents.

It is bounded agents.

Or more precisely:

bounded wrongness.

The model can fail.

The authority boundary should still hold.

There is a trap here.

When people hear “agent governance,” they often imagine a human approving every action.

That doesn’t scale.

If autonomous software is going to matter, most legitimate actions need to happen without waiting for someone to click approve.

The human should define the boundary.

The machine should operate inside it.

Approval becomes one possible decision for actions that cross a boundary requiring human judgment.

That means:

Humans create natural friction.

Software doesn’t.

An autonomous system can make one bad decision and immediately make another.

And another.

And another.

The first failure can become a loop before anyone opens the logs.

That is why observability alone isn’t enough.

Evidence after execution matters.

But there is a profound difference between:

“Here is what the agent did.”

and:

“The agent was not authorized to do it, so it never ran.”

One helps you investigate damage.

The other can prevent that particular unauthorized action from becoming damage.

We need both.

Now take the idea beyond one agent.

A company begins with an engineering assistant.

One becomes ten.

Ten becomes 147.

Eventually nobody can answer the simplest governance question:

What can they actually do?

This stops being an AI feature.

It becomes organizational infrastructure.

I think enterprises will eventually need a new map.

Today they map people.

Autonomous systems introduce another graph:

machines and their authority.

And those authorities will change.

Constantly.

The important enterprise question becomes:

Where can autonomous authority reach?

That’s a different map from identity.

And I think companies will eventually consider it just as important.

Inside one organization, you can build almost anything.

The more interesting problem begins when autonomous software crosses organizational boundaries.

Company A’s agent calls Company B’s system.

Company A knows the agent.

Company A knows why it delegated authority.

Company B does not belong to Company A.

Company B should not have to surrender control to Company A’s IAM.

And Company A should not have to expose its internal authorization system to Company B.

This creates a fundamental requirement:

Authority must be able to move.

But acceptance cannot move with it.

Company A can say:

We delegated this authority to this machine.

Company B still gets to say:

We don’t accept it here.

That distinction matters.

Or put another way:

This is why I don’t believe the future should be one enormous centralized agent gateway deciding what everyone on the internet may do.

That would recreate the wrong problem.

If an agent reaches my infrastructure, I should retain the final say over what happens inside my boundary.

That is how organizations can cooperate without merging their security models.

Portable authority. Local acceptance.

The network can become more connected without becoming one security domain.

We sit at a narrower boundary.

The agent wants to act.

The operator has defined authority.

The receiving system has its own rules.

Keydris helps answer:

Is this action authorized before it runs?

Then the actual tool does what tools do.

It executes.

Or it fails.

Those are different outcomes.

That distinction is important.

There is a temptation in infrastructure to describe the destination as though it already exists.

I don’t want to do that.

Keydris is early.

Today, we are proving a narrower idea:

Can the result be:

Those are concrete questions.

The larger network is a direction.

It is not something I want to pretend we’ve already built.

The world doesn’t owe Keydris a category.

Good.

Infrastructure should be falsifiable.

The test isn’t whether I can write a convincing essay about authority.

The test is whether developers with real agents encounter this problem and choose to install an authority boundary before consequential actions.

If they don’t, the thesis fails.

Software is being given tools.

Every increase creates another question:

How much authority follows?

I don’t believe the answer can permanently be:

Whatever the credential can reach.

That is too much inherited authority for a world of autonomous actors.

Software needs something more explicit.

The internet grew up around access.

The autonomous internet adds another dimension.

Once connected:

What may this machine actually do?

That is why I think we’re moving from an access-centric world toward an authority-centric one.

Not replacing identity.

Building on it.

Not replacing authentication.

Separating it from the authority to act.

Not replacing policy.

Making authority itself something operators can govern.

The transition sounds subtle.

I don’t think it is.

Because once software acts, permissions stop being configuration sitting in the background.

They become part of the execution path.

If this works inside one company, something larger becomes possible.

One organization issues explicit machine authority.

Another knows how to evaluate it.

Then another.

Then another.

The more systems that can evaluate explicit machine authority, the more useful issuing it becomes.

The more organizations that issue it, the more useful evaluating it becomes.

Not because everyone shares one policy.

The opposite.

Because everyone retains their own.

The network isn’t valuable because Keydris decides for everybody.

It becomes valuable if different parties can understand authority without surrendering sovereignty.

That is the long-term bet.

A neutral authority layer for autonomous software.

Infrastructure.

Quietly sitting between intention and consequence.

I started Keydris because I couldn’t get past one question.

Not:

Can the agent do it?

Agents will be able to do almost anything software can do.

Not:

Can we identify the agent?

That problem matters, and an enormous amount of infrastructure already exists around identity.

The question was:

I think that question gets bigger as agents get better.

We don’t need to make autonomous software powerless.

We need to stop confusing power with permission.

We don’t need a human clicking every button.

We need the human’s authority to survive when the human leaves the loop.

We don’t need every organization to trust every agent.

We need every organization to retain the right to decide what authority it accepts.

And we should not wait until after an autonomous action has caused damage to ask whether it should have been allowed.

Ask before.

Software is beginning to act.

Now we have to decide what it is allowed to do.