As autonomous agents begin to act on behalf of people and organizations, a foundational question becomes urgent: how does a system know an agent is who it claims to be, that it is authorized to act, and that it can be held accountable?
The Problem
Identity and access infrastructure was built for two actors, humans and static services, not for delegated, autonomous agents:
- No native agent identity. There is no standard way to issue, verify, and revoke an identity for an agent acting on a principal's behalf.
- Delegation is ad hoc. Sharing credentials or long-lived tokens gives agents far more authority than intended and is impossible to scope or audit.
- Authorization is coarse. Today's permissions cannot express constraints like spend limits, time windows, or task scope for an agent.
- Accountability is missing. When an agent acts, there is no reliable trail linking the action to a principal, agent, and grant.
Why Now
- Agents are gaining real authority. They are beginning to move money, access systems, and execute consequential actions.
- Standards are forming. Work on agent identity, scoped delegation, and verifiable credentials is converging.
- Security teams are demanding controls. Enterprises will not deploy agents without scoped, auditable, revocable access.
What We're Funding
- Agent identity providers. Systems that issue, verify, and revoke agent identities and bind them to a principal.
- Scoped delegation and authorization. Fine-grained, constrained grants, spend, scope, and time-bound, for agent actions.
- Verification and accountability. Audit trails, attestations, and provenance linking every agent action back to its grant.
gAI's Bet
We back founders building the trust layer for the agent economy, the identity, delegation, and authorization infrastructure that makes autonomous action safe enough for enterprises and consumers to rely on.
End of thesis · T7