We're Handing AI Agents Master Keys. That Should Terrify Us.

There is a particular unease in handing someone a key. A house key, a login, the password to the room where the important thing lives. The instinct is to check who they are once, decide they're trustworthy, and let them in. That works because a person clocks out. They get tired, they go home, you can picture what they'll do with the access you gave them. Now imagine the holder never sleeps, makes a decision every few milliseconds, and there are a thousand of them. You can't watch any of it. You just have to hope the one check at the door was enough.

That is, more or less, how the invisible machinery running most of the internet decides who may change it. A software agent is handed a set of standing credentials — a permission slip that doesn't expire and doesn't track what it has already done — saying it may open firewall ports, rewrite network rules, spin up servers. The check happens at admission, like a guard glancing at a badge. After that, the agent roams. This was built for human engineers who log in to fix something and leave. It was never built for a system that acts on its own, continuously, at machine speed.

A recent proposal, from a team building something they call a Sovereign Execution Broker, takes the obvious-once-you-hear-it position that the standing key is the problem, and removes it. No agent ever holds a permanent credential. Every single time it wants to act, it must present a signed certificate, one that can only be issued by a trusted authority and can't be forged. The broker then does something the badge-at-the-door model never does: it checks whether the world actually matches what the agent believes. Is the firewall really in the state the agent thinks? Only if everything lines up does it issue a one-time, fast-expiring token, good for that single action and nothing else. Instead of a master key, every door demands a fresh code, issued only after someone confirms you have a reason to open it right now.

The objection is immediate: that is an enormous amount of checking, for every action, in a world that runs in milliseconds. Surely it grinds to a halt. It doesn't. For a routine network change, the broker's own processing adds about 28 milliseconds, less than the gap between pressing a key and seeing the letter appear. For the same kind of change on Amazon's servers, it adds around 137, still less than half the time it takes to blink. Fast, for what it is doing. The cryptography is the cheap part; most of those milliseconds are just waiting for the cloud to answer. Across a thousand attempts at each kind of attack — replayed requests, stolen credentials, a faked picture of the world — it blocked all of them.

The catch is that the broker becomes the one thing you must trust completely. If it goes down, everything stops, by design; it fails locked, not open. And because these systems are always slightly behind themselves, there's a sliver of a moment where the agent's view of the world is already stale. Better, not perfect. We are building machines that can act faster than we can watch, and then racing to build something that can watch them anyway.