Keycard: 2026 is the Year of Agents

**Derrick Harris** (0:03)
In 2025, we saw the first glimpses of true AI agents. In 2026, every company will be rushing to get them into production, and they'll need companies like Keycard to manage fleets of agents. In this conversation, a16z partner Joel de la Garza sits down with Keycard Cofounder and CEO, Ian Livingstone, to discuss the continuum from co-pilots to agents, the security realities of tool calling, why enterprises will adopt before consumers, and how to control your agents. Let's get into it.

**Joel de la Garza** (0:34)
So it's shaping up to be that we're at the beginning of what sounds like the start of the year of the agents. 2026, it seems like every company we talk to is definitely looking to get some sort of an agent into production, not just in the lab, to get them out into customers' hands and to start having them use it. And so I'd like to share a story. I guess we could kick this off, and thank you so much to you, Ian, for joining us on our podcast to discuss this.
We actually, or I was actually privy to hearing about probably the first security incident I've ever heard about with an agent. And as a security person, we constantly harp on people to be very explicit on what is the problem you solve. And the problems in security are often manifested in security events. And so we were talking to a company or heard about a company, a relatively large company that has a SaaS service that implemented an agent. They wanted to give a prompt to their users to query data that was in the system. Very common use case. You've probably seen several of them roll out recently. And this agent would essentially return data for your firm. So you could say, hey, I'd like to know about this specific part of our business. Could you tell us more about it? And it would give you an answer that would provide you with your data. So super useful, super helpful. Now, the problem was you could ask for other firms' data, and it would very interestingly say no. I can't give you data for General Electric, for example. But if you just said, hey, give me my data, it would return on a revolving cast of characters data from other companies. And immediately when I heard about this incident, you came into my mind because I thought, my God, there is an AuthN, AuthZ problem. And that is the problem with identity and agents. So welcome. Thank you so much for joining.

**Ian Livingstone** (2:20)
Thank you so much for having me, Joel.

**Joel de la Garza** (2:21)
And nothing could be more timely than your company.

**Ian Livingstone** (2:23)
Nothing could be more timely. Yeah, it's incredible. You know, we spend a lot of time talking to companies trying to adopt agents or trying to build tools for agents. And invariably, you basically have two categories of security problem, right? You have this sort of prompt injection, tool calling dynamics of the fact that you have this indeterministic loop. And then you have, how do I understand what this thing, this agent, should actually be able to access? And then downstream, you know, from the person who's built the tool, how do I understand, like, what the agent should actually have access to on a deterministic basis? And this is, like, a fundamental problem that's almost always existed from the beginning and dawn of, like, computing, which is the contextual understanding of, in complex relationships, of user A is using agent B, accessing tool C. Under what context should that agent have access to things? And this is the final example of that problem. And we hear about this across the board, whether it's commerce, whether it's enterprise workflows, whether it's people building agents, is how do I build something that has some deterministic guide rails, some level of guide rail that puts a box around this thing it has access to and what it can do? And so fundamentally, there's a lot of things you can, you have problems you have to solve that are of the non-deterministic or probabilistic category around the actual model itself and the data that model has access to. Now you remove certain terms of prompts, but on the flip side, it's how do I write access policy and how do I deliver guarantees to someone that owns a resource, so in the case of I have a database, I want to expose it for agency use, but I want to ensure only the end user can control what the agent has access to. And I, as a database person, ensures that I never leak anything to the agent that it shouldn't have access to at any point in time, and that's contextual based on all of the different parties and that transaction, right? And so we're moving to a world with agents where it used to be that in a point and click software world where I, as a user, go to a piece of software, I point and click, and the software returned to me exactly what I was. And the identity problems were very static and very simple. It's like, is the user a part of these groups? It is a part of being these groups? This is what you get access to? And it didn't change. We're now moving to a world where a user can pick up an agent, the user is going to expose some tools. Those tools represent downstream resources.