Vendor and Product Reality
Token Security is a non-human identity security platform built around a machine-identity-first view of the enterprise. As publicly described, it discovers and catalogs the non-human identities across an organization, service accounts, tokens, keys, certificates, and the workloads and agents that use them, correlates each to its owner and its access, and continuously assesses exposure so that risky or orphaned identities can be remediated. Its emphasis is the catalog: a single, continuously maintained inventory of machine identities and their relationships, on the premise that an organization cannot secure what it cannot see. Given how fragmented machine-identity data is across cloud and SaaS, an authoritative catalog is a real and valuable thing to build.
The Architectural Axis: Catalog and Continuity
A catalog and a continuity primitive operate at different layers. The entries in a catalog are existing credentials, secrets and keys and tokens, each a static artifact whose validity is a matter of whether it has been issued and not yet revoked. The catalog records what exists and how risky it is, and each cataloged entry remains a transferable artifact whose authenticity is a binary issued-or-revoked status rather than a verifiable history. A static credential carries no successor state, so the property of proving that a present state legitimately follows from a past one is supplied at a different layer. Visibility into a population of such credentials is valuable, and it is a different thing from changing what the credential is.
What the Keyless Primitive Provides
Keyless identity supplies that layer: each identity carries cryptographic continuity of its own. Identity is an append-only chain of validated dynamic hashes, called a trust slope, so authenticity is not a binary issued-or-revoked flag but a verifiable history: a principal proves it is itself by demonstrating that its present chained state legitimately follows from states a verifier has witnessed. In the described embodiments such an identity is not replayable from a captured artifact, because what a verifier checks is the successor relationship rather than a stored artifact, and the chain is entangled to its host device.
A skilled implementer can build this. Each step advances under an update rule of the form DAH_t = H(DAH_t-1 || freshness_t || salt_t || tag), where each successor binds the immediately prior identity to a fresh, non-exported source of unpredictability and a domain-separating tag. The unpredictability source has several enabling embodiments: a static hardware anchor (TPM, TEE, or SoC identifier) keyed with a per-epoch volatile salt; a stability-tuned local state vector (timing deltas, scheduler jitter, performance counters, I/O micro-jitter) passed through a strong extractor; or a hybrid concatenating both in the same step. Optional biometric or behavioral inputs (fingerprint, voiceprint, gait) may be folded in through a privacy-preserving fuzzy extractor with liveness verification to supply additional local unpredictability. A verifier accepts a presented successor only if it is an on-slope descendant of a previously trusted state under policy-bounded continuity checks, and agent-side mutations additionally require a host-signed entanglement trace whose mutation token opens to the executing device identity. Continuity survives disconnection and memory loss through periodic anchors, bounded proof windows for delayed replay, and quorum-based recovery from previously trusted peers.
A catalog of keyless identities records continuity rather than credentials, and risk assessment over it asks whether a chain's history is coherent rather than whether a secret has leaked. Cataloging remains useful; what it catalogs becomes identities that carry their own proof.
Category Convergence
Token Security confirms that the enterprise needs an authoritative, continuously maintained view of machine identity. The keyless primitive addresses what is being cataloged: in the described embodiments the identities are self-proving and are not replayable from a captured artifact, so that visibility is over continuity rather than over a sprawl of static secrets. The two compose: maintain the catalog, and migrate the cataloged identities toward computed continuity so that what is inventoried cannot be stolen and reused. No relationship, endorsement, or infringement is asserted; the comparison is architectural.
Disclosure Scope
The keyless identity mechanism, in which identity is a validated, append-only chain of dynamic hashes that proves itself by verifiable continuity rather than by a static, replayable credential, and which is device-entangled, is disclosed in United States Patent Application 19/388,580. The claims of this article concerning what the invention does trace to that filing. The characterization of Token Security, the non-human identity security category, and the surrounding market is external context drawn from publicly available materials; it is provided for architectural comparison only and is not part of, or a claim of, the filing. References to Token Security are used for comparison only, and no relationship, endorsement, or infringement is asserted.
