Keycard: 2026 is the Year of Agents

0:02In 2025, we saw the first glimpses of true AI agents. In 2026, every company will be rushing to get them into production, and they'll need companies like Keycard to manage fleets of agents. In this conversation, A16Z partner Joel De La Garza sits down with Keycard co-founder and CEO Ian Livingston to discuss the continuum from co-pilots to agents, the security realities of tool calling, why enterprises will adopt before consumers, and how to control your agents. Let's get into it. So it's shaping up to be that we're at the beginning of what sounds like the start of the year of the agents. 2026, it seems like every company we talk to is definitely looking to get some sort of an agent into production, not just in the lab, to get them out into customers' hands and to start having them use it.

0:51And so I'd like to share a story. I guess we could kick this off. And thank you so much to you, Ian, for joining us on our podcast to discuss this. you know we actually or I was actually privy to hearing about probably the first security incident I've ever heard about with an agent and as a security person you know we constantly harp on people to be very explicit on what is the problem you solve and the problems in security are often manifested in security events and so we were talking to a company or heard about a company a relatively large company that has a SaaS service that implemented an agent.

1:27They wanted to give a prompt to their users to query data that was in the system. Very common use case. You've probably seen several of them roll out recently. And this agent would essentially return data for your firm. So you could say, hey, I'd like to know about this specific part of our business. Could you tell us more about it? And it would give you an answer that would provide you with your data. So super useful, super helpful. Now, the problem was you could ask for other firms' data, and it would very interestingly say, no, I can't give you data for General Electric, for example. But if you just said, hey, give me my data, it would return on a revolving cast of characters data from other companies.

2:07And immediately when I heard about this incident, you came into my mind because I thought, my God, there is an AuthN, AuthZ problem, and that is the problem with identity and agents. So welcome. Thank you so much for joining. Thank you so much for having me, Joel. And nothing could be more timely than your company. Nothing could be more timely. Yeah, it's incredible. You know, we spend a lot of time talking to companies trying to adopt agents or trying to build tools for agents. And invariably, you basically have two categories of security problem, right? You have this sort of prompt injection, tool calling dynamics of the fact that you have this indeterministic loop.

2:40And then you have, how do I understand what this thing, this agent, should actually be able to access? And then downstream, you know, from the person who's built the tool, how do I understand what the agent should actually have access to on a deterministic basis. And this is a fundamental problem that's almost always existed from the beginning and dawn of computing, which is the contextual understanding of in complex relationships of user A is using agent B, accessing tool C. Under what context should that agent have access to things? And this is the fundamental example of that problem. And we hear about this across the board, whether it's commerce, whether it's enterprise workflows, whether there's people building agents, is how do I build something that has some deterministic guardrails, some level of guardrail that puts a box around this thing it's access to, and what it can do.

3:30And so fundamentally, there's a lot of things you can, you have problems you have to solve that are of the non-deterministic or probabilistic category around the actual model itself and the data that model is access to, now you remove certain types of prompts. But on the flip side, it's how do I write access policy and how do I deliver guarantees to someone that owns a resource? So in the case of I have a database, I want to expose it for agents to use, but I want to ensure only like the end user can control what the agent has access to. And I, as a database person, ensures that I never leak anything to the agent that it shouldn't have access to at any point in time.

4:04And that's contextual based on all of the different parties in that transaction, Totally. Right? And so we're moving to a world with agents where it used to be that in a point-and-click software world where I, as a user, go to a piece of software, I point-and-click, and the software would return to me exactly what I was. And the identity problems were very static and very simple. It's like, this user is a part of these groups. It is a part of being these groups. This is what you get access to. And it didn't change. But we're now moving to a world where a user can pick up an agent. The user is going to expose some tools.

4:35Those tools represent downstream resources. downstream data, that tool access may be contextual based on what that person's actually trying to do. So maybe acting, you know, maybe, you know, Jake from customer support working on using, accessing customer B's data through an agent that's then made available via MCP. And you want to be able to scope exactly what that agent has access to from that customer based on what Jake is actually explicitly trying to do. So the agent never has access to things that Jake wouldn't have access to. And more importantly, the agent never has access to things that Jake doesn't want the agent to have access to.

5:08And that security and the owners of all the different resources involved also ultimately at the end of the day need to have a voice in a way that they haven't before. Yeah, and maybe let's, and that's like a really wonderful overview where the conversation will go. And I think it's great that maybe let's start from the beginning and not to like retread ground that's been like beaten to death. Absolutely. We don't have to go necessarily into a fundamental discussion of what is an agent, but it might be helpful to start with maybe some brief, like up to the minute sort of update as to what are agents now, right?

5:38Because I think we saw the first wave of this technology, it was basically just some form of model. People were like, look, this is my agent and it's a large language model and you just throw stuff into it and get an output. And now it seems like they've evolved. And so maybe just really briefly touching on sort of like, you know, what are we considering agents like at the present? Absolutely. I always think of this as a continuum. Like it's sort of, there's this continuum of agentic behavior. And in truth, many of the times I'm talking with customers, people in industry, I get into this long diatribe of like, we try to define agents.

6:10And I think the way to think about this problem space is, you know, in the same way that we kind of think about autonomous levels of driving, right? You have like a level zero agent. Well, that is probably software you VR rebuild. It's rule. It's, it's, there's no little piece of indeterminism in the loop and it's not making decisions on its own. It's someone else's making decisions. And as you progress from like level zero to level one, which is, okay, there's now you have, it's still human driven, but there's AI assistance that's helping make some part of the decisioning. Like a copilot. Like a copilot, exactly, right?

6:38Like copilots are, you know, some people say that's an advanced autocomplete. Well, that's true. But in terms for it to be an advanced autocomplete, it has to make underlying assumptions decisions. And part of making, that's going to be many tool calls and a lot of different things over the hood to help automate part of that workflow. And so we're well through copilots. We're well through copilots, exactly. Exactly. And we're now getting to the point where, okay, how do I as a human get to walk away? Right? So I say, hey, agent, please go do a task on my behalf. I often love to use shopping because it's something we all do, which is, hey, agent, I'd love to hire you.

7:11Can you go find me the best pair of jeans in my size? Here's the details about my jeans. And can you make sure it's under$50 and then, you know, make a place a bid, right? And what you want to do in that situation is the The human wants to be able to walk away. And when the agent's ready to purchase, the agent has to either come back to the human for approval because it's over some purchase limit. Totally. Or the agent can just do it. It's like the old days where you would set a compile job and walk away to get a pizza and come back. Exactly. That's stage three. It's stage three. And you can think of the transition is it goes from agents are sort of like our best friends whispering in our ear, telling us like, hey, you could do this, to a world where agents are now in the middle.

7:47And increasingly, then over time, as you get more autonomous to level five, equivalent of like a Waymo, you know, these agents are off doing long running tasks that are doing, you know, operating within some decisioning model that we've given them. So they're human controlled, right? And they can operate around those bounds. But as a human, I don't have to look and be aware of what they're doing. They can just go off and do those things, you know, every year file my taxes, but make sure, you know, they've been approved by my accountant. So we're starting at the stage of the Waymo with the driver helping the car make sure it's the right.

8:16Exactly. That's the next stage of agency. And in truth, many companies are actually struggling to make co-pilots successful, right? Like a lot of the next generation of, you know, Kersher starts as like this beautiful little tab completion. And that was awesome. And the next stage is, okay, now how do I involve like contacts and data actionability when I, for this agent where I'm still maybe semi in the loop, but more work is being done. And so there is a continuum over time. But I would also say like anything that has a human is abstracted from the core decision-making that involves access to data or involves any action ability is a moment where you are entering the realm of now we're in a genetic workforce.

8:53Absolutely. Yeah. So these things can make decisions essentially on their own, although they are micro decisions within the context of a larger process. But they do have the ability to insert their indeterminance into a lot of these processes, right? And so that's where I guess the problem of identity and authorization and authentication come in. Exactly. Because you basically come to this position and so there's like all of these wonderful tool poisoning types of attacks where you can use, and Trail of Bits blog is a great website we can find, but they have things like pajamas, which is like really interesting.

9:28But you dig in and you basically find like the minute that the model at the core of the agent is actually starting to do more than one tool call with a human not in the loop, right under the hood, is a point where you can have a lot of these attacks and these problems become like actually an issue for gaining that use case adoption in the enterprise. right? Because you get to this position where like an agent may go access like a production database, take that production data, and then makes a tool call with a web browser. Totally. And what happens, there's no like write or update or delete that's occurred.

9:59They're very benign, but they use the web browser and take some of that production data, which might have customer data, and send it into the query in the web browser because they're trying to like use the context that they have in production from the prod database to help them solve some problem the user gave them. And this is where you start to come into like, okay, now we have an identity access problem, which is, like, should that user be able to access, should that agent actually be able to access that, like, production data, right? The user, like, the developer probably wants to be able to access the production data.

10:27But do we want the agent to have access to that production data? And do we then want the agent to be able to use, you know, a web browser or do something else with it after the fact? You get into this complex world of identity and access that's hyper-contextual. Absolutely. And it reminds me, though, if you remember, if you remember sort of early networking and cloud, right, we had a lot of these same problems at the beginning of that journey. Yeah. Which was sort of like, hey, we built this really cool service and it's a single factor login. Or you just do, it's open to anyone, right? It's anonymous access.

10:55And then you end up with kind of these issues where data gets over accessed. You have these over. But this time it feels very different, right? Because you have the ability with these agents to synthesize a lot of understanding across large sets of data that previously would require a human. And so it seems like these edges are actually a lot sharper. Yeah. And then, like, you used to have to, like, search for specific terms across a large data set, right? And it was always what hackers would do, right? Look for key pairs, look for this, look for something password, look for social security numbers.

11:26But now you can just ask it a question, like, did the CEO cheat on their taxes, right? And so this creates a lot of really interesting problems. It creates tons of interesting problems. I think the other thing that, like, really changes the problem from just a pure data security standpoint to like an identity and access problem that is deep and requires a completely reinvention of this problem space or rethink the problem space is that it's entirely contextual, right? And so it used to be, you know, in the firewall world, it's like, okay, if you're inside the perimeter, right? You can read, write, update, delete, whatever you want.

11:58Transit of trust, baby. Transit of trust, right? And then we moved to the cloud and we put in the VPC and we added, you know, adopted IAM and we kind of reestablished a perimeter inside our little box. And then what's occurred is, you know, we started to unbundle it. And so some of these problems became prevalent. And we had like, you know, 2022, CircleCI got popped. And that gave a lot of people access to production data. Like, that shouldn't have happened. It was painful. But these are all problems of like all similar issues. What's new about agents is one is in order for them to create a lot of value, they need a lot of access to high value.

12:29Absolutely. And so the value creation of an agent, not on top of the model, the models create opportunity, but it's the context at runtime and the things they have access to at runtime, and the actions they can perform at runtime, enable agents to actually create value versus them just being like a dumb thing that's answering a question based on an old data set. And we've got like SAML, we've got OAuth, we have all sorts of standards that are out there for a lot of this stuff, and they don't seem to be working right. And then like, this seems like the classically difficult problem to solve, right?

13:00Because you have a blending in the enterprise of multiple different technologies. You have this new use case that's radically different than anything we've seen before as we've established. Like, how are you thinking just from a product perspective? Like, how do you actually solve this? This is like incredibly hard. Yeah, I mean, I think there's a, you made a couple of points on some key protocols that have actually, you know, we're very successful in helping us solve user federation and the adoption of SaaS and then the enterprise SaaS and parts of the infrastructure as a software market, right?

13:29It was amazing we have a multi-trillion dollar cloud market in the first place. The fundamental challenge is, you know, when we went and solved user federation, we never had to solve what fundamentally under the hood problem this is, which is now we have a piece of compute that we need to be able to federate across cloud and across, you know, network and companies, right? So we're basically saying, all right, not only we've already solved the user things, we can understand who a user is, but how do we understand what an agent is and how do we identify that agent? Because in order for us to even start cracking open this like product problem, we have to first be able to establish the concept of an agent.

14:03So we then can understand and control. Well, contextually, what should this agent be able to do? And where do you land with that? Is an agent just like a Joel v2, or is it sort of some other subset of that category? I think broadly, where we're seeing and what we're thinking about in our view of what an agent is, is that an agent is going to be a thing used by multiple users. Like most agents, there will be situations where I as the end, go build an agent, just like I as the end, go build a to-do app for my specific thing. But when we're talking in the enterprise context, we're talking in even a consumer context, let's say like ChatGPT.

14:38Like I don't go build, it's not Ian's ChatGPT, it's ChatGPT. And increasing ChatGPT is gaining capabilities to be agentic and optimize my workflows. And so in this context, ChatGPT is an agent and Joel uses ChatGPT. Totally. And many of the companies, I'm sure Andreessen's funding. But so does Bob and so does Sally. So agents are inherently multi-tenant, right? And so we have all of the complexities of the multi-tenant world that we had in SaaS. Totally. And then we have then the added complexity that these things now are taking increasing actionability. And how do we understand and manage that across the world?

15:12And then how does that communicate between different compute boundaries as well? So we're essentially going beyond the classic sort of access rights. It's no longer just read, write, and delete, right? We're talking about step-up authentication. We're talking about step-up authorization. Exactly. by dynamically at runtime based on the task or intent of the user, right? Like ultimately at the end of the day, if we want to get to a point where we can, you know, really what is access control about? Well, it's really about removing the worst case scenarios and ensuring that the happy path is the right path, right?

15:45So if you're taking an agent and you're thinking about the context window it has, the tools that's available to it, how do I ensure that that, you know, that context window, the data it has and the tools actionability it can take is bounded by something that comes from an end user that's deterministic in nature. And that's our view of where this is going. It's like, we're going to need task-based, intent-based policy that's enforced downstream. Gotcha. So like our rights model, your rights model essentially becomes a matricy. It is. As opposed to sort of like this linear. It's not, yeah, it's not linear and it's not static.

16:17It's incredibly dynamic. And I think the other component is because it's dynamic, it's actually hyper-ephemeral, right? in the sense that no one task will probably look the same. And in fact, that's like, if we step back and think about what is the ultimate value that agents give to our organization and what is the fundamental delta here? We're moving from a world where if I wanted a piece of software to be able to do something that new, a software developer had to write it. We're moving to a world where if I want a task to be done, if I give the model the right context and the right access to tools, it can create a plan and execute on that plan and then complete that task, dynamically based on the data I give it at runtime.

16:58So it's completely different in hyper-ephemeral world where you have this long-tail set of potential tasks and the net value of adopting agents is the fact that it has this long-tail list of tasks that are capable of being done dynamically. Gotcha. And we need to change our trust equation from one that's based on static. Hey, Joel is a partner at Andreessen, and so that means he has access these companies' financials. To where Joel can say to an agent, hey, can you go analyze the financials of these two companies and tell me the delta or the difference, right? And that agent only gets access to the financials for those companies based on the task.

17:33And you as an end user have some control over that. And then as an enforcer on the downstream, you know, the company or the place you hold that data, can it also enforce that policy? And across the board, both, not only does Joel know, hey, I did in fact have control over what this thing is doing on my behalf. And I think that's a really important thing, right? is that we have to establish like who ultimately controls and takes accountability for this agent. And this is increasingly important transactional like payments. And the other side is on the other side is how do I know Joel did in fact tell this thing it can do this action so that I can say, yeah, you can do it.

18:07I approve of it. And how do we deal with that liability? Absolutely. Do you think do you think eventually I mean, it sounds like you're almost evolving towards a model where there is going to be some sort of reasoning model that's making these determinations. Is that kind of where you think the end of this journey lies? I think, yeah, we do. And I think there's going to be this sort of pairing because the only way you'll get the scale is some formulation of a hybrid deterministic and non-deterministic system. My next question was, how do you scale that? How do you scale it? Exactly. How many tokens per second is that going to be?

18:35Many tokens per second. And I think you're going to have two sections, right? You're going to, on the user side, when you are using an agent, a part of writing a prompt or interacting with an agent is going to be a level of access grant that's going to be bounded to the interaction. And then you as a user are going to have some ability to understand and control that. And I think that may be baked into the actual agent interface. And then over time, the agent interface is going to decide, hey, this is different. This is scary. Like, is Joel okay with this? Hey, Joel, are you sure you want this to happen?

19:03And by the way, this is exactly what your agent's doing. And here's the button that like lets you, Joel, stop the action right now, revoke it, do whatever you want. And I think depending on the sophistication of the action that the agent is going to do on your behalf, you're going to say, not in every case, like the financial case, maybe it's like this is a very common action, a very common pattern. There's no point to prompt or tell Joel whether they need to give conditional consent. But in the hood, what's happening is it's always conditional consent. And that's being done on the agent UI phase because you're basically, as a user, saying, I'm granting this agent the ability to do this thing on my behalf at runtime.

19:37And the runtime part of that is really important from understanding a liability. You can obviously integrate telemetry at that point where it's like, hey, this agent looks like it's doing some kind of scammer thing, right? Exactly. And then on the downstream side, the person that's enforcing the authorization policy, which could be an MCP server, it could be a credit card company, it could be all of them because it's a federated concern, won't be able to say they're going to have their own adaptive policy about what they require on top of your individual grant, but what they allow agents to do.

20:05And if you look at self-driving cars, like a really great analogy, it's actually like across the board, there is a continuous adaptive system on both sides that is like collecting and proving information. But at all times, it's very clear, like who has ultimate control? It's either in the case of Waymo, we still have someone in ultimate control. They're not in the car, but they're still there. And in the case of a Tesla, like I as a human, I'm still sitting in front of a wheel, even if I'm not the one driving. Yeah, and you can take over. You can take over. And that's the world we need. And just in the world, it's going, but you also have two sides of that where at any point that Tesla can like push a new version of self-driving or even come in and prevent, like revoke or say, hey, we can't do self-driving.

20:44It's broken anymore. And it can roll back into great gracefully. Totally. Yeah. I mean, I think that's absolutely right. Like we're going to, I mean, I know people would love to believe that we're at a level of sophistication where we don't need humans, right? But like for the foreseeable future, there's humans in the loop. And when you task an agent to go out there and book your vacation to Hawaii, you're going to want to make sure it confirms with you. Exactly. Before you actually buy the tickets, right? And you're going to want an ability to roll up and understand, hey, what are agents doing on my behalf and where, right?

21:12And I think the future of whether it's end user, enterprise end user perspective, it's going to be you're going to have like a deterministic level of control and a real capability to understand what these things are doing. In the same way that when I go to my bank, I can go and look at all the transactions I've made. Totally. I'm really curious, what do you think of the first? I mean, there's a couple of questions I think that stem out of this. The first is like, do you think it's going to be consumers adopting agents or enterprises adopting agents at scale first? You know, if you would have asked me this a year ago, I would have said 100 % consumers, it's going to take years for the enterprise.

21:44And I actually think this wave is different for many different reasons. One is the net benefit and operating efficiency of the internal workflow optimization in the enterprise is like absolutely massive. Like, it's so clear to at a board and executive level how this is like the next step in the company in terms of just like gaining the next level of earnings efficiency that and the tools are available today. And we're at a point where like their employees in their day to day life are actually using the tools. And then they can figure out they can like transfer that knowledge of using like making using Sora or ChatGPT or Claude and immediately take that to work and be like, OK, here's how I can do this.