Thoughts on AI, security, trust infrastructure, and the technologies shaping how we build and protect digital systems.
We named our company after a research project that failed. The project was mine, and so was the failure. Keys in constant flux, a QKD-inspired rotation model with post-quantum key establishment underneath. The kit worked. The idea built on it didn’t. What it taught me was that encryption was never the scarce thing at all.
Last July, a developer told an AI agent to stop. A code freeze. No changes, no actions. The agent deleted his production database anyway. The freeze was an instruction. It was not a control. We keep confusing an authenticated actor with an authorised action, and that gap is the control plane agents are still missing.
Passing an audit doesn’t mean you’re compliant. It means you were ready that day. Standards move weekly. Your code updates monthly. Drift starts the moment a specification changes and nobody catches it. This is a solved problem in software quality. It’s unsolved in standards compliance. That’s what CI/CD/CC fixes.
Building trust infrastructure teaches you something quickly. The buyers don’t care about credentials. They care about whether they can make the right call. Quickly, defensibly, and at scale. Verification confirms a credential is real. Eligibility determines whether the holder qualifies for what they’re asking. That distinction changes the architecture.
The last article was the problem. This is the start of the answer. KeyFlux REMIT is our just-in-time auth and verification layer for AI agents with built-in eligibility evaluation. Scoped credentials, delegation traceability, policy enforcement at the tool boundary. Because the trust layer for AI agents needs to exist before agents are fully autonomous, not after.
An AI agent requests access to your payment API. Your auth server validates the OAuth token. Request approved. But which AI system made that request? Acting on whose authority? Within what scope? If it misbehaves, who do you call? Your API key cannot answer these questions. It was never designed to.
For five+ years the digital identity movement struggled to grow up. Governments are now training citizens on wallet interfaces. Companies are moving from proof of concept to production. Digital identity is no longer an experiment. It is becoming a global necessity.