Vendor and Product Reality
Keycard is a recent, well-funded entrant building identity and access management specifically for AI agents rather than for human users or traditional workloads. As publicly described, its approach treats an agent as a first-class principal that is issued scoped, short-lived credentials to act on a user's or organization's behalf, with policy controlling what each agent is permitted to do and an audit trail of agent actions. The framing is current and correct about the problem: an agent that acts autonomously needs an identity distinct from the human who launched it and from the service it calls, and the static API keys and shared service accounts that agents are improvised onto today are a liability. Keycard is part of the wave of capital and engineering that formed around this realization, and on its own terms it is a real product addressing a real gap.
It also reaches, more than most, toward identity continuity rather than mere credential issuance, which is what makes it worth examining closely. The question is where the continuity is anchored.
The Architectural Choice: A Token Issuer
At the cryptographic layer, Keycard's model is issuer-based. An authority mints a token that an agent presents, and a relying party trusts the token because it trusts the issuer. Scoping the token narrowly and shortening its lifetime are genuine improvements over a static key, and policy over agent behavior is valuable, but the identity primitive underneath remains a credential handed down by an issuer. The agent's ability to prove who it is depends on the issuer being reachable to mint and on the relying party trusting that issuer's signature, and the continuity the product reaches toward is continuity the issuer maintains on the agent's behalf rather than continuity the agent computes from its own activity. Remove the issuer from the loop, or compromise the issuing key, and the identity has nothing of its own to fall back on.
What the Keyless Primitive Provides
Keyless identity removes the issuer entirely. An agent's identity is an append-only chain of dynamic hashes advanced only by independently validated interaction, and its standing is a trust value that any verifier reconstructs by replaying the chain. No authority mints the credential, because the credential is computed from the agent's own validated history; no relying party holds or trusts an issuer's signing key, because it validates that the agent's present chained state is the legitimate successor of states it has witnessed. The continuity that Keycard maintains for the agent through an issuer is, in the keyless model, intrinsic to the agent: it is the agent's own chain, entangled to its hardware so it cannot be lifted, recoverable through peer quorum rather than re-issuance. The result is identity that survives the issuer being unreachable and has no issuing key whose compromise yields impersonation.
Category Convergence
Keycard is evidence for the thesis, not a target of it. That a credibly funded team is building agent identity around scoped, short-lived, continuity-seeking credentials confirms that the market is moving in the keyless direction: away from static secrets, toward dynamic and earned identity. Keycard advances along that axis and stops at the issuer; the keyless primitive is the same axis taken to its end, where there is no issuer left. The two are complementary in posture: a deployment can adopt issuer-based agent IAM today and migrate the identity primitive underneath it toward computed continuity as the keyless model is adopted, without changing the policy and audit layers built on top. No relationship, endorsement, or infringement is asserted; the comparison is architectural.
Disclosure Scope
The keyless identity mechanism, in which identity is a validated, append-only chain of dynamic hashes with a computed trust value, device entanglement, and quorum recovery, and which requires neither a certificate authority nor a credential issuer, is disclosed in the identity filing (U.S. Application No. 19/388,580, published as US 2026/0126730 A1). This article compares that disclosed mechanism with Keycard's publicly described issuer-based agent IAM and positions the keyless primitive as the issuer-free endpoint of the same convergence. References to Keycard are to public materials and are used for comparison only.
