The Missing Principal in Your Slack Agent
I ask teams the same question early in every conversation about agents: when an agent does something on behalf of a user, can the audit log tell you that it was the...
Continue reading
Agent Baseline: What Must Be True When an Agent Acts
Security requirements did not change when we introduced agents. What changed is the execution model: we added another actor...
The Missing Authorization Layer in GitHub Actions
In March 2025, attackers compromised tj-actions/changed-files, a GitHub Action used in over 23,000 repositories. A single...
Announcing Keycard Support for ID-JAG and Cross-App Access from Okta
Today we're announcing Keycard support for ID-JAG, the Identity Assertion Authorization Grant, the open standard behind...
Keycard x Insecure Agents: Building a Big Tent for Agentic Security
Today, we're excited to announce that Keycard is sponsoring the growth of Insecure Agents, and that its host, Allie Howe, is...
Announcing Keycard for Multi-Agent Apps: Auth for Agentic Systems
Today, we're excited to announce Keycard for Multi-Agent Apps: identity, access, and telemetry for developers building...
The Agent Security Stack: Transport, Identity, Policy, Runtime
Let's say you're building an agent. It reads Linear issues, pulls context from Gmail, opens GitHub PRs, and posts updates in...
How to Authorize AI Agents Using Token Exchange Open Standards
Your agents have too much access You have a coding agent. It needs to call an API, so you generate a static API key, paste...
The Vercel Breach: How OAuth Became the Supply Chain
The Vercel Breach: How OAuth Became the Supply Chain Breaches often happen because an attacker exploits a vulnerability, but...
I Built a Keycard Agent to Run Event Raffles
We just came back from a great RSAC 2026. At our expo booth, attendees could enter a raffle to win a Flipper 0 or a Mac Mini....
Bringing Verified Device Identity to Agents with Smallstep
Today, we're excited to announce a strategic partnership with Smallstep to bring hardware-attested device and workload...
Securing Always-On Agents: Keycard Meets OpenClaw
Keycard secures how coding agents access external services - identity, scoped credentials, policy enforcement, audit trails....
Announcing Keycard for Coding Agents: Unlocking Autonomy without Sacrificing Security
Today, we’re excited to announce Keycard for Coding Agents: identity, access, and governance for Claude Code, OpenAI Codex,...
I Built and Authorized a Planning Agent with MCP and Keycard
My workday is scattered across many disconnected tools: Google Calendar, Linear, Gmail, Google Docs, GitHub, Slack, and...
Keycard Joins the Agentic AI Foundation
Today we're excited to announce that Keycard is joining the Agentic AI Foundation (AAIF) as a Gold Member, alongside...
Agents Aren't Apps, And $26 Billion Proves It
While participating in the AI Security Summit, someone on Jared Hanson's panel said something that got under my skin: "It's...
Coding Agents Are Ungovernable, We're Fixing That: Keycard acquires Anchor.dev.
Keycard acquires Anchor.dev to bring runtime security to autonomous coding agents. AI writes nearly 100% of all code at...
Making MCP Production-Ready: Keycard acquires Runebook
Today, we're excited to announce our acquisition of Runebook. Their team joins Keycard to accelerate our ecosystem of...
The Federated Trust Fabric for the Agent-Native Era
Introducing Keycard: identity & access management for AI agents, with $38M in funding Today we're incredibly excited to...
