Keycard Acquires Anchor.dev to Unlock Autonomous Coding Agents

Developer and Security Teams No Longer Have to Make Tradeoffs Between the Autonomy, Capability and Security of Coding Agents

Keycard, the provider of the identity and access platform for AI agents, announced that it has acquired Anchor.dev to extend its platform to govern coding agents. Anchor.dev was a stealth startup focused on making certificate issuance and validation automatic; the team has deep expertise in building infrastructure that developers trust at companies like Cloudflare, GitHub and Heroku.

Ian Livingstone, co-founder and CEO of Keycard, said: “Security shouldn’t be something developers have to think about, it should just work. Keycard’s focus on agent identity combined with Anchor’s experience in developer infrastructure puts us in a unique position to help unlock the potential of autonomous coding agents.”

AI coding agents such as Cursor, Claude Code, Codex and Windsurf are shipping production software but their capabilities and autonomy are constrained by the ability to govern them. Most organizations rely on static credentials and human approvals for every tool call which makes real autonomy impossible. Existing vendor approaches either constrain agents’ natural capabilities to a narrow set of MCP-only workflows or apply controls at the wrong layer or point in time, such as at the network boundary or during initial authentication. None of these can govern what an agent does once it is running without drastically limiting either the agent’s capabilities, autonomy or the scope of what can be governed.

Also Read: AiThority Interview with Zohaib Ahmed, co-founder and CEO at Resemble AI

With this acquisition, Keycard eliminates the need for this tradeoff by evaluating policy on each tool call at the application layer. New capabilities of Keycard’s identity and access platform for AI agents will include:

• Application-layer policy enforcement at runtime: Policy is evaluated per task and per tool call, where agents actually execute actions, rather than at login, the network boundary or through protocol-specific proxies.
• Protocol-agnostic support for the full agent toolchain: Agent behavior is governed consistently across MCP workflows, CLI commands, APIs and agent-generated tools, enabling the long tail of applications and patterns used in modern software development.
• Explicit tool governance with full visibility: Teams define which tools an agent is allowed to use, and every tool invocation, successful or failed, is evaluated, logged and attributed to a specific agent and task with support for additional metadata.
• Identity-bound, task-scoped credentials: Static secrets are replaced with short-lived credentials issued per task and cryptographically bound to the agent, their delegates and the application being accessed.
• Portable agent configuration across environments: Agents are configured once and can be used across laptops, sandboxes and production systems without reconfiguration, using cryptographically attested runtime context.
• Autonomous workflows with built-in guardrails: Routine actions proceed without human involvement, while sensitive operations can still require explicit approval, enabling autonomy without sacrificing security or control.

“At Anchor, we focused on removing operational complexity from certificates: automatic issuance, validation and renewal,” said Wesley Beary, former CEO of Anchor.dev, now at Keycard. “At Keycard, we’re applying that same discipline to coding agents: real identity, scoped access, policy enforcement per action and full visibility. That’s what makes autonomous coding practical in production.”

Keycard’s identity and access platform identifies AI agents, lets users assign task-based permissions and dynamically enforces policy while tracking all activity. With Keycard, organizations can deploy AI agents into production with governed access, knowing they are only capable of performing the intended actions of their users and builders without limiting the tasks they can perform. Teams can get started quickly by adopting agents and supplying them with tools through one-click installation, while developers can build and publish their own agents and tools using Keycard’s drop-in SDKs.

Keycard’s mission is to unlock the power of AI agents by giving developers and enterprises the foundations they need to build and adopt trusted agentic applications at scale. Its identity and access platform provides real-time, contextual guardrails, enabling the transition from static, human-driven workflows to machine-driven, autonomous, agentic applications. Keycard is a remote-first company and backed by Andreessen Horowitz, boldstart ventures and Acrew Capital.

Also Read: The Death of the Questionnaire: Automating RFP Responses with GenAI