Agentic AI boom continues with funding for Keycard, protocols for payment giants

Keycard has emerged from stealth with its identity and access platform for AI agents, joining the growing number of firms aiming to address the challenge of managing nonhuman participants in the digital ecosystem.

According to a release, Keycard’s platform identifies AI agents, lets users assign task-based permissions and “dynamically enforces policy” while tracking all activity. It’s all designed to keep agentic AI in line, sticking to the tasks it has been assigned by human overlords who are increasingly in the minority, numbers-wise.

“AI agents represent a once-in-a-generation shift, greater than the SaaS and cloud wave combined,” says Ian Livingstone, CEO of Keycard, setting up the kicker. “But without trusted access controls, they can’t leave the lab. Keycard provides the guardrails that allow agents to act safely on behalf of people and businesses, unlocking the true potential of the agent economy.”

Transformative potential comes with risk of agentic mutiny

It’s not hard to see the opportunity-as-problem-as-opportunity in the hype around agentic AI. As phrases like “vibe coding” enter the lexicon, there is a push to sell AI agents as the transformation large language models have promised, but thus far failed to deliver. At the same time, there is much emphasis on the need to control agentic AI in the workforce and beyond, and on solutions that promise to do so.

Keycard says agents “spawn by the thousands and operate autonomously across systems and organizational boundaries.” They need different permissions, depending on their assigned task; an agent gone rogue could cause a major security incident. “Existing solutions were not architected for AI agents. They were built for a world of static, human-driven point-and-click interactions and not the machine-driven dynamic, ephemeral and autonomous nature of AI agents.”

Keycard cites CyberArk’s 2025 Identity Security Landscape to suggest that “AI is expected to drive the creation of the greatest number of new identities with privileged and sensitive access.”

For all the hype, however, it’s useful to consider recent comments from OpenAI cofounder Andrej Karpathy, whom Business Insider calls the “de facto leader of the vibe-coding boom.” In a podcast interview, Karpathy says agents aren’t yet everything they’re cracked up to be.

“They just don’t work. They don’t have enough intelligence, they’re not multimodal enough, they can’t do computer use and all this stuff. They don’t have continual learning. You can’t just tell them something and they’ll remember it. They’re cognitively lacking and it’s just not working.”

Karpathy believes “it will take about a decade to work through all of those issues.” He echoes doubts from Gartner, which recently declared that “most agentic AI propositions lack significant value or return on investment (ROI), as current models don’t have the maturity and agency to autonomously achieve complex business goals or follow nuanced instructions over time. Many use cases positioned as agentic today don’t require agentic implementations.”

Keycard founders bring experience from Okta, Snyk

Keycard is headed by heavy hitters: co-founder Jared Hanson was chief architect at Auth0 before joining Okta as a senior technical leader, and is the creator of Passport.js. Livingstone and third co-founder Matthew Creager built the platform engineering and developer experience divisions at Snyk.

They have purpose-built Keycard’s identity and access platform for AI agents. The platform vetoes agents to ensure they are authorized backed by federated, standards-based protocols. It contributes to emerging standards including Model Context Protocol (MCP), WIMSE and OAuth extensions for agents and is the first production implementation with support for OAuth 2.1 Client ID Metadata Documents in MCP. Its dynamic, identity-bound and task-scoped tokens enable the enforcement of policy automatically without additional code: “these tokens are tied to the agent’s attested workload identity, compute provider or device for end-to-end trust.” Its identity-aware data model can revoke access with a single API call.

Keycard’s IAM platform for AI agents offers comprehensive security and management.

None of that answers the question: can AI agents really do what their evangelists say they can, leading to the promised demand for agentic IAM?

38M in funding says agentic AI is here to stay

Investors believe the answer is yes. Andreessen Horowitz, boldstart ventures and Acrew Capital have announced a 38 million dollar seed and Series A funding round for Keycard – another investment to add to the ballooning figure representing what AI means to the U.S. economy.

According to a release, Andreessen Horowitz and boldstart ventures co-led the 8 million dollar seed round, and Acrew Capital led the 30 million Series A. Angels who participated include Ian Andrews (CRO at Groq), Ryan Carlson (president at Chainguard), Emilio Escobar (CISO at Datadog), Karl McGuinness (former chief product architect at Okta) and Matias Woloski (co-founder and former CTO at Auth0).

Zane Lackey, partner at Andreessen Horowitz, calls this “the Auth0 moment for agent access. The agent ecosystem needs foundational authorization infrastructure. This team has the rare combination of infrastructure expertise and standards leadership required to build it.”

Asad Khaliq, founding partner at Acrew Capital, says that “trusted agents define the next chapter of computing. Developers will lead the way and need durable identity and access foundations. Keycard extends trust and control to the agent layer.”

Visa, Mastercard launch frameworks to support agentic commerce

Two of the largest payments providers also see the potential in agentic AI – in their case, as a new cohort of shoppers. Digital Commerce 360 reports that both Visa and Mastercard have introduced separate frameworks to support a boom in agentic commerce. The goal is to “give merchants a way to verify trusted AI agents and confirm shopper intent, as well as process payments with less friction.”

Cloudflare’s Web Bot Auth technology, developed in collaboration with Microsoft, Shopify, Checkout.com, Worldpay, Adyen and others, powers the tech for both, potentially allowing AI agents to transact across “millions of merchants globally.”

“Securing the future of commerce is a shared responsibility, especially as AI agents begin to act on behalf of consumers,” says Stephanie Cohen, Cloudflare’s chief strategy officer, in a statement. This, in fact, is already happening. Part of what motivated Visa is data from Adobe showing the 2024 holiday season as a tipping point, with generative AI traffic to U.S. retail sites taking a huge jump. By July 2025, Adobe said “generative AI-driven visits had jumped 4,700 percent year over year, based on click-throughs that led to purchases.”

Mastercard’s chief digital officer, Pablo Fourez, outlines some of the critical dilemmas  merchants face as AI agents become customers. “How can they distinguish between legitimate AI agents and malicious bots? How do they know the consumer authorized the agent to make the purchase? How can they know if the agent has carried out the consumer’s instructions correctly?”

Visa has its Trusted Agent Protocol, which centers on three capabilities: “signaling agent intent, recognizing the consumer behind the agent and transmitting payment credentials.” In effect, it helps authorized agents pass payment credentials to merchants.

Mastercard’s Agent Pay Merchant Acceptance Framework registers and authenticates agents before any transaction. In effect, it serves the same purpose as Visa’s.

Agentic infrastructure developing around ‘big bet on AI’

It has been the autumn of agentic AI protocols. OpenAI launched Instant Checkout for Etsy sellers via its Agentic Commerce Protocol, co-developed with Stripe. Google launched its Agent Payments Protocol (AP2), allowing AI agents to complete transactions securely, even without direct shopper involvement. And American Express is planning to join the club in adopting Cloudflare’s Web Bot Auth standard as part of its own agentic commerce strategy.

Fortune magazine recently declared that “America has become one big bet on AI.” Agentic AI is its army of worker drones. All that remains to be seen is whether or not they can do the job.

Article Topics

AI agents  |  funding  |  identity access management (IAM)  |  Keycard  |  Mastercard  |  Visa