Identity Is Not Authority: Why AI Agents Need a Chain of Authority

Ledger built its reputation by isolating cryptographic keys from compromised computers and phones. It is now applying that principle to a broader question: how do you let an AI agent prepare or initiate consequential actions without making the agent itself the final authority? A payment, treasury movement, credential change, or access grant can be technically valid and still be unauthorized in the way that matters. Ledger's answer is deliberately narrow. It does not try to make the agent infallible. It tries to secure the mandate, the limits, and the moment when digital intent becomes an act.

The urgency is not theoretical. On July 1, 2026, the security firm Sysdig documented JADEPUFFER, an agentic threat actor that exploited a vulnerability in Langflow, an open-source framework for large language model applications. Once inside, it autonomously chained reconnaissance, credential harvesting, lateral movement, and database extortion. When a login step failed, it diagnosed and corrected the problem in thirty-one seconds. The significant point was not a novel attack technique. It was that the orchestration of known techniques had become autonomous, adaptive, and fast enough to change the economics of attack.

To understand why Ledger is repositioning around this problem, I spoke at length with Charles Guillemet, Ledger's CTO and founder of its offensive security lab, the Donjon. His argument begins not with agents, but with the economics of security itself.

When “good enough” stops being good enough

For decades, defensible security rested partly on asymmetry. As Charles frames it, many attacks remained unattractive when finding and exploiting the last weakness required months of work from rare, expensive specialists. Residual flaws could exist, but the cost and uncertainty of reaching them often protected systems economically even when protection was not perfect.

AI compresses that cost. It accelerates code analysis, automates parts of vulnerability discovery, lowers the expertise needed to exploit what it finds, and increasingly helps orchestrate what follows a breach: reconnaissance, credential theft, lateral movement, exfiltration, or extortion. Charles is blunt about the direction of travel:

“Finding vulnerabilities and exploiting them is becoming cheaper and cheaper. The cost tends toward zero, even if it is obviously not zero.”

The consequence is not simply that attacks get cheaper. It is that the defender's structural advantage erodes. The defender still has to close many paths; the attacker needs only one that works. Giving defenders AI improves speed and coverage, but it does not automatically recreate the cost gap that once made many attacks irrational. When discovery and exploitation costs fall sharply, systems that were economically defensible despite residual weaknesses become materially less so.

The early signals are already visible. In late 2025, Anthropic disclosed that it had disrupted a cyber-espionage campaign it attributed with high confidence to a Chinese state-sponsored group. Its model performed an estimated 80 to 90 percent of the campaign against roughly thirty targets, with humans intervening only at a small number of critical decision points. Defensive AI matters, but this example illustrates the larger shift: organizations increasingly need to limit what a compromised or misdirected system is actually permitted to do.

Intelligence becomes abundant, authority becomes scarce

A second shift compounds the first, and it is the one enterprise leaders should focus on. Model competition is becoming a cost curve as much as a capability race. Inference prices are falling, specialized models are multiplying, and more capability can run locally on a laptop, device, edge system, or inside enterprise infrastructure. The practical result is that far more software can analyze, plan, and act with limited supervision.

As intelligence becomes more abundant, capability alone becomes a weaker control point. Authority becomes the scarce resource. The operative question is no longer only what an agent can do, but what it is permitted to execute, on whose behalf, for how long, under which conditions, and how that authority can be revoked. Ledger's work points toward a chain-of-authority structure that serious enterprise deployments will need: an explicit mandate, an accountable human principal, a verifiable agent identity, a bounded authority envelope, contextual authorization at the moment of action, and an evidentiary trail afterward.

Separating cognition from authority

Many current agent architectures still rely on API keys, tokens, or delegated credentials embedded in software. That can collapse two functions that should remain distinct: cognition and authority. A model may reason about what should happen. It should not therefore possess unconstrained secrets or rights that allow it to make that outcome irreversible.

Ledger's Agent Stack, opened to developers in June 2026, starts with the assumption that the agent can be wrong, prompt-injected, or operating inside a compromised software environment. The current toolkit lets software prepare and propose transactions while private keys remain isolated inside a Secure Element, the class of secure chip widely used in bank cards and biometric passports. The effect of the operation can be rendered on the device's own trusted screen, independently of the computer or phone that prepared it.

The February 2025 Bybit incident is a useful cautionary case. Roughly $1.5 billion in assets were stolen after attackers compromised the signing interface used for a multi-signature transaction. Signers believed they were approving a legitimate operation while the underlying transaction logic had been altered. The primary failure was not a broken cryptographic primitive. It was the gap between what the humans believed they were authorizing and what the system actually executed. Charles's design principle addresses exactly that gap:

“Our goal is to avoid giving secrets directly to the agent. The agent prepares the intent, and the user verifies on their device the transaction they are consenting to.”

This is more precise than a generic 'human in the loop.' A probabilistic layer researches, interprets, and proposes. A deterministic policy and signing layer decides whether that proposal can become an act. The hardware does not prove that the model reasoned correctly. It limits the consequences when the model is wrong or compromised, because the enforcement layer does not interpret a prompt or an argument. It applies a cryptographic rule. For developers, Ledger already exposes programmable tooling through APIs, command-line interfaces, and agent-oriented skills so that models can interact with the wallet stack without ever taking custody of the private key.

Autonomy is really a mandate problem

Approving every action by hand would defeat the point of autonomy. Giving an agent open-ended permission would defeat the point of governance. The viable middle path is bounded delegation: policies define what the agent may do automatically, and human authority re-enters only when the action exceeds those boundaries. As Charles describes the model:

“As long as the agent stays within the defined policy, it can act automatically, without a human in the loop. The moment it steps outside, the human is asked on their device to accept or reject the action.”

The underlying policy pattern is not new inside Ledger. Its enterprise offering already uses hardware security modules and user devices to enforce granular transaction policies and approval thresholds. Ledger's planned Agent Intents and Agent Policies extend that principle into agentic workflows: an operator or agent can act inside a predefined perimeter, while actions outside it are routed back to an authorized human. The distinction matters. This does not magically secure every decision an AI agent might make. It can enforce only those consequential actions that pass through a cryptographic or policy-controlled execution point.

The distinction enterprises consistently underweight is that identity is not authority. Knowing who issued a request does not establish who mandated it, for what purpose, for how long, or under what revocation rules. A machine-interpretable mandate has to be explicit, bounded, traceable, and revocable, or the human step becomes theater rather than control. Designed well, human involvement becomes an escalation mechanism rather than a permanent gate: the agent operates inside a predefined authority envelope, and a person is pulled in only when risk, value, or the nature of the action crosses a threshold. The hard part is triggering the right person, at the right moment, with the decision presented clearly enough to avoid approval fatigue.

Proof of Human is one input, not the answer

Ledger's 2026 roadmap also includes what it calls Proof of Human. The phrase sounds like a single guarantee, but Charles is careful to unbundle it. As agents become harder to distinguish from people in digital interactions, no single mechanism can establish human legitimacy with absolute certainty:

“There is no solution that lets you prove with certainty that you are interacting with a human. The goal is to make it much harder for an agent to impersonate that person.”

The architecture is better understood as layered evidence rather than a single proof. A genuine hardware device can provide cryptographic attestation that raises the cost of large-scale impersonation. Identity can then be bound to that device in privacy-preserving ways, including zero-knowledge techniques that disclose only the attribute required for a decision. A passport-derived credential, for example, could prove that a holder is over eighteen without exposing a birth date or the full document. Biometrics can add evidence of presence, but Charles is firm that they should not become a master secret: biometric traits are neither truly secret nor easily revocable.

Emerging liveness approaches are worth watching precisely because they focus on genuine human presence rather than trying to turn the body into a reusable password. But even strong liveness evidence does not establish authority by itself. A person can be present and still not understand, intend, or legitimately approve a specific action. Proof of Human is therefore one input to point-of-action authority, not a substitute for the authorization stack.

From digital ownership to digital action

Ledger already reaches beyond crypto in a limited but important way. Its Security Key application can turn a Ledger device into a FIDO2 or U2F hardware authentication key. The broader strategic leap is from protecting ownership of digital assets to protecting authorization of digital action: who can approve an act, on what device, within which policy, and with what cryptographic evidence.

Ledger's 2026 roadmap extends this with agent identity, programmable skills and command-line interfaces, Agent Intents and Policies, and Proof of Human. The ambition is to make the policy layer generic enough to protect a broader class of digitally signed actions. The boundary remains important: hardware is a powerful enforcement point when a critical action can be routed through it, but it is not a universal governor for every decision an agent makes inside a high-volume software system.

Charles's five-year view is that this shift opens new verticals around identification, authentication, and above all the protection of critical assets, on the consumer side through devices and on the enterprise side through hardware security modules and other roots of trust. His underlying conviction is the through-line of the conversation:

“In an agentic world where we trust less and less what is executed and by whom, hardware and roots of trust become more and more important.”

What this means for enterprise leaders

For an executive evaluating agentic deployments now, three implications follow, and none of them are crypto-specific.

First, separate intelligence from authority. High-stakes actions such as payments, access grants, credential changes, or data deletion should be gated by controls that a compromised agent or software stack cannot silently override. Hardware-rooted approval is one credible design pattern for the most consequential actions, but the broader principle is architectural separation between the system that proposes and the system that authorizes.

Second, replace permanent human supervision with bounded autonomy and risk-based escalation. 'Human in the loop' does not scale if it means approving every action. A more practical control model lets agents operate automatically inside a predefined mandate and calls a person back only when an amount, risk level, target, or action type crosses an agreed threshold. This is not less governance. It is governance designed for machine speed.

Third, treat policy design as a governance function, not just an engineering task. Defining the mandate, authority envelope, escalation thresholds, expiry conditions, and revocation path demands the same rigor as a financial delegation-of-authority matrix, and probably the same sign-off chain. Identity verification and authority verification also require different evidence. A system can authenticate an actor perfectly and still fail to prove that a specific action was legitimately authorized.

The hard problems that remain are therefore not primarily cryptographic: making policies interoperable and auditable, organizing revocation, preventing rubber-stamp approvals, preserving evidence across systems, and assigning responsibility when an agent faithfully executes a badly designed mandate. Those are governance and accountability problems.

The next phase of AI competition will be fought as much over authority as over models. Conventional identity and access management answers who or what may enter a system. Agentic systems must also answer who authorized this specific action, under which mandate, within what limits, at what moment, and with what evidence. Hardware can prove that a rule was applied. It cannot prove that the rule was the right one. That remains a human governance responsibility.

As intelligence becomes abundant, the differentiator will not be how much autonomy an organization can grant. It will be whether that autonomy can scale without losing the chain of authority behind every consequential act. 

Adapted and expanded from the author's original French-language chronicle, “Après les cryptoactifs, Ledger veut sécuriser l'action numérique à l'ère des agents IA,” published on Alliancy, 31 July 2026, and drawn from the author's extended interview with Charles Guillemet, CTO of Ledger.