Vendor and Product Reality
Keycard is a recent, well-funded entrant building identity and access management specifically for AI agents rather than for human users or traditional workloads. As publicly described, its approach treats an agent as a first-class principal that is issued scoped, short-lived credentials to act on a user's or organization's behalf, with policy controlling what each agent is permitted to do and an audit trail of agent actions. The framing is current and correct about the problem: an agent that acts autonomously needs an identity distinct from the human who launched it and from the service it calls, and the static API keys and shared service accounts that agents are improvised onto today are a liability. Keycard is part of the wave of capital and engineering that formed around this realization, and on its own terms it is a real product addressing a real gap.
It also reaches, more than most, toward identity continuity rather than mere credential issuance, which is what makes it worth examining closely. This article positions Keycard's publicly described agent IAM against Keyless Identity, the inventive step disclosed in United States Patent Application 19/388,580, in which an agent's identity is not a credential handed to it but an append-only chain of dynamic hashes it advances itself. The question is where the continuity is anchored.
The Architectural Choice: A Token Issuer
At the cryptographic layer, Keycard's model is issuer-based. An authority mints a token that an agent presents, and a relying party trusts the token because it trusts the issuer. Scoping the token narrowly and shortening its lifetime are genuine improvements over a static key, and policy over agent behavior is valuable, but the identity primitive underneath remains a credential handed down by an issuer. The agent's ability to prove who it is depends on the issuer being reachable to mint and on the relying party trusting that issuer's signature, and the continuity the product reaches toward is continuity the issuer maintains on the agent's behalf rather than continuity the agent computes from its own activity. Remove the issuer from the loop, or compromise the issuing key, and the identity has nothing of its own to fall back on.
What the Keyless Primitive Provides
Keyless identity removes the issuer entirely. An agent's identity is an append-only sequence of dynamic hashes, a trust slope, in which each step is computed from the immediately prior step and a source of non-exported unpredictability under a published update rule. Its standing is reconstructed by any verifier that replays the chain from a previously trusted state and confirms the presented successor is a valid descendant under policy-bounded continuity checks. No authority mints the credential, because the credential is computed from the agent's own validated history; no relying party holds or trusts an issuer's signing key, because it validates continuity locally rather than a signature over an issued token.
The disclosure enables a skilled implementer to build this without an issuer and describes several interchangeable embodiments. The per-step unpredictability can be drawn from a static hardware anchor combined with a per-epoch volatile salt, from a stability-tuned local state vector transformed by a strong extractor, or from a hybrid that concatenates both, so the same primitive spans constrained sensors and richer platforms. Each agent-side mutation is entangled to the executing host's device identity through a host mutation token and a host-signed entanglement trace, so an identity cannot be lifted off the device on which it evolved. After memory loss, an agent rejoins the trust graph by aggregating signed attestations from previously trusted peers under a quorum policy rather than by re-issuance. Sparse checkpoints, periodic anchors, and bounded proof windows allow delayed and offline verification, and a segregated legacy adapter permits interoperability with PKI counterparties without contaminating slope formation. The result is identity that survives the issuer being unreachable and has no issuing key whose compromise yields impersonation.
Category Convergence
Keycard is evidence for the thesis, not a target of it. That a credibly funded team is building agent identity around scoped, short-lived, continuity-seeking credentials confirms that the market is moving in the keyless direction: away from static secrets, toward dynamic and earned identity. Keycard advances along that axis and stops at the issuer; the keyless primitive is the same axis taken to its end, where there is no issuer left. The two are complementary in posture: a deployment can adopt issuer-based agent IAM today and migrate the identity primitive underneath it toward computed continuity as the keyless model is adopted, without changing the policy and audit layers built on top. No relationship, endorsement, or infringement is asserted; the comparison is architectural.
Disclosure Scope
The keyless identity mechanism, in which identity is a validated, append-only chain of dynamic hashes with continuity reconstructed by replay, device entanglement, and quorum recovery, and which requires neither a certificate authority nor a credential issuer, is disclosed in United States Patent Application 19/388,580. That filing is the sole subject matter claimed here. The characterization of Keycard, of agent IAM generally, and of the market convergence described above is external context drawn from public materials; it is offered for comparison only and is not part of the filing, and no relationship, endorsement, or infringement is asserted.
