Nuggets Launches Authority Control Plane for Autonomous AI Agents

Your autonomous AI agents are placing orders, processing invoices, and querying databases right now. Here is the uncomfortable reality: If an agent goes rogue or gets compromised, downstream systems have no way to verify who actually owns it, what it was authorized to do, or how to shut it off without crashing adjacent infrastructure. Shared API keys do not prove ownership. Static OAuth service accounts do not track agent intent. And when an auditor under the EU AI Act asks who is accountable for an automated action, a generic server log will not suffice. MCP and A2A standardized how agents speak to tools—CodeB solves how servers verify who is speaking. Today, we are launching AI Agent Machine Identity inside the CodeB Business Wallet. Built on European Digital Identity Wallet (EUDI / eIDAS 2.0) architecture and W3C standards, CodeB gives every autonomous agent a cryptographic identity legally anchored to your organization. Key Capabilities: - Decentralized Agent Identity (did:web): Assigns fragment DIDs (did:web:...#agent-123) cryptographically bound to your corporate wallet. - Least-Privilege Capability Tokens: Issues short-lived ES256 JWTs clamped by dynamic scopes and strict TTLs. Administrative functions are permanently blocked for agents by design. - Instant One-Click Kill Switch: Calling deactivate-agent immediately revokes access across every downstream service via live manifest and Bitstring status updates. - EU AI Act Auditability: Produces signed, append-only audit trails linking agent execution directly to organizational liability (Articles 12, 14, and 26). - Zero New Stack Required: Operates out of the box as a standard bearer credential for MCP tool servers, A2A dispatchers, and REST APIs. Stop running autonomous agents on shared secrets and implicit trust. Read the technical breakdown and explore the live implementation: https://lnkd.in/efTiUkrG #DigitalIdentity #EUAIAct #MachineIdentity #EUDIWallet #DecentralizedIdentity #Cybersecurity #CodeB #EnterpriseSoftware

When an AI agent does something it should not have done, the enterprise asks two questions: what happened and who authorized it? Application logs cannot answer that. They are editable, single-source, and carry no record of the authority the agent was acting under. That is a description of events, not evidence. You cannot govern what you cannot prove. We call the fix Agent Runtime Attestation: an independently verifiable, tamper-evident record of what a governed agent did, cryptographically signed and correlated across a run, so it proves who did what, under what authority, why it was allowed or denied, and what happened. Think chain of custody for every agent action. Alter it after the fact, and it breaks verification instead of quietly rewriting what occurred. Prevention and detection get the attention today, but they are only worth deploying if you can prove afterward that they worked. Attestation is the evidence layer on which everything else rests and the precondition for running agents in finance, healthcare, and critical infrastructure. Full write-up, including where it maps to SOC 2, the EU AI Act, and NIST: https://lnkd.in/g7uAr86s #AgentRuntimeGovernance #AgentRuntimeAttestation #AISecurity #AgenticAI #CISO

When an AI agent does something it should not have done, the enterprise asks two questions: what happened and who authorized it? Application logs cannot answer that. They are editable, single-source, and carry no record of the authority the agent was acting under. That is a description of events, not evidence. You cannot govern what you cannot prove. We call the fix Agent Runtime Attestation: an independently verifiable, tamper-evident record of what a governed agent did, cryptographically signed and correlated across a run, so it proves who did what, under what authority, why it was allowed or denied, and what happened. Think chain of custody for every agent action. Alter it after the fact, and it breaks verification instead of quietly rewriting what occurred. Prevention and detection get the attention today, but they are only worth deploying if you can prove afterward that they worked. Attestation is the evidence layer on which everything else rests and the precondition for running agents in finance, healthcare, and critical infrastructure. Full write-up, including where it maps to SOC 2, the EU AI Act, and NIST: https://lnkd.in/gucDFEQJ #AgentRuntimeGovernance #AgentRuntimeAttestation #AISecurity #AgenticAI #CISO

Vouch Protocol basics. Part 5 of 7: Delegation chains. You give an AI assistant read-only access to your calendar. It spins up a helper to draft replies. That helper spins up another to send them. Three hops later an email goes out that you never approved. You ask the obvious question, who authorized that, and nobody can answer. With shared tokens, each handoff is just "here, use my access," and authority quietly blurs and grows as it moves down the line. A signed action just tells you what happened. It doesn't tell who allowed it. That's one of the important missing pieces in multi-agent systems. Vouch helps create a chain of authority. A person grants some authority to an agent. That agent can pass part of it to a helper, and so on. Every link is signed, so you can follow the trail all the way back to the human at the top. And the authority can only shrink along the chain. An agent that can read and write can hand a helper read-only. That helper can't grant itself write access, and it can't pass on more than it was given. Every hop narrows the scope. That's what makes a swarm of agents something you can control, and have predictability of agent actions. It brings stability. No matter how far a task fans out, whatever the agents can do at the edge is provably a smaller slice of what one person granted at the start. Next: why trust in Vouch isn't a one-time stamp. vouch-protocol.com #AIAgents #AgenticAI #Security

1Kosmos CSO Michael Engle explains in latest Forbes post why human-in-the-loop sounds responsible, but does not scale when AI agents are making hundreds or thousands of decisions across enterprise systems. Delagated authority needs a runtime authorization framework to keep business processes safe and humming along. Find out more: https://lnkd.in/gAhZ8Xq9 #AIGovernance #AIAgents #IdentitySecurity #RuntimeAuthorization

The LLM was never the hardest part. The hard part is everything around it: governance, memory, security, orchestration. My colleague Jim Rowan breaks down why the "agent harness" is the next enterprise AI battleground. http://bit.ly/4bosJJw Deloitte

Calling out the chatbot loop is a necessary reality check. Most enterprises are just trying to put a fancy interface on top of messy, manual processes that humans have spent years navigating through sheer willpower. You can't build autonomous agency on top of a foundation where the state of truth is constantly shifting and undocumented. Treating agents as non-human identities isn't an optional security feature, it's the core architecture. If your infrastructure doesn't have a way to govern continuous, autonomous execution with cryptographic accountability, you're just creating a massive surface area for technical debt and risk. It's an operational overhaul, not a new plugin. #AgenticAI #EnterpriseIT #Infrastructure #AI #SoftwareArchitecture

Agentao Runtime Enhances Governance and Security for Tool-Using LLM Agents 🛰️ [SECURITY] Agentao secures tool-using LLM agents locally. Why it matters: As LLM agents gain capabilities to interact with local systems and external protocols, security and governance become paramount. Agentao provides a critical layer of control, mitigating risks associated with autonomous agent actions, thereby enabling safer deployment of powerful AI tools in sensitive environments. 🤔 How can the balance between agent autonomy and host governance be optimized for maximum utility and minimal risk? #LLMAgents #AISecurity #Runtime #Governance #ToolUse 📡 Follow DailyAIWire for high-signal AI news.

Your AI stack is only as trusted as its dependencies. Malicious releases of a widely used AI proxy library exposed credentials across 2,500 organizations and hundreds of thousands of CI/CD pipelines. The attack targeted the supply chain directly. The package, not the application. AI pipelines now sit at the center of enterprise infrastructure. Attackers know this. One compromised shared dependency moves through the stack faster than any perimeter control catches it. The fix is runtime enforcement, not package audits alone. Every tool call and external dependency an agent invokes needs to be validated against an allowlist at the moment it runs. Before credentials or data are passed. RuntimeAI closes this gap at the runtime layer, before it lands. #SupplyChainSecurity #AIInfrastructure #AgentSecurity #CISecurity #RuntimeAI