Keycard Labs Inc., a startup developing software to manage identity and access security for agentic artificial intelligence, today announced it has acquired Anchor.dev, a startup focused on security certificate management.

Through this acquisition, Keycard is bringing on a team with deep experience providing developer infrastructure for companies such as Cloudflare Inc., GitHub Inc. and Salesforce Inc.’s Heroku, with a focus on making identity primitives such as certificates automatic, reliable and invisible to developers.

“As agents take on more responsibility: opening pull requests, running commands, and touching production systems. Developers are forced to delegate real authority,” Keycard co-founder and Chief Executive Ian Livingstone told SiliconANGLE. “Most teams handle this today by keeping humans in the loop or by artificially constraining agents to a small set of tools that are easier to secure. That limits autonomy and breaks the promise of agentic development.”

This problem fundamentally curtails the essential usefulness of agents inside regulated or private environments, where secrecy or security are paramount.

Developers increasingly have come to rely on coding agents such as Cursor, Claude Code, Codex and Windsurf to write and modify code that will ship to production environments. However, permitting these agents access to live systems such as source control, issue trackers, observability platforms and internal services open up a company to security and compliance risks.

Livingstone explained that Keycard uses a different management paradigm to identity by providing short-lived, task-based credentials that govern access independent from the tool. When an agent creates its own tools, when running “bash commands” or using MCP-based integrations, the same identity, policy and audit model applies.

At the end of the line, developers never need to approve every action or lock agents into narrow workflows to maintain control. Agents receive clear guardrails and sensitive activities still receive clear oversight with credentials.

“This acquisition strengthens Keycard’s role in giving developers practical, production-grade controls for AI agents as autonomy becomes the default way software is built,” Livingstone added.

Keycard said the acquisition will expand the company’s platform with protocol-agnostic access to govern agent actions across Model Context Protocol, command line tools and agent-created tooling to a single identity. It would deliver per-action auditability for every application programming interface call, CLI command or generated tool, logged with agent identity.

Although it is autonomous by default, allowing routine actions to proceed without human involvement, sensitive actions can still require explicit approval by humans.

“At Anchor, we focused on removing operational complexity from certificates: automatic issuance, validation and renewal,” said Wesley Beary, former CEO of Anchor.dev, now at Keycard. “At Keycard, we’re applying that same discipline to coding agents: real identity, scoped access, policy enforcement per action and full visibility.”

Image: Pixabay