Machine Authority Control Plane
Nihar Shah@nehharshah
−5.5%
since Oct 15
The idea
As AI agents start spending money, deploying code, and acting on our behalf, someone has to grant them authority, enforce the rules, and prove what happened. I'm backing the companies building that control plane: identity and security firms that already govern machine access across clouds and apps get most of the weight, with smaller positions in the big cloud platforms that enforce actions directly, a verification layer, and payment networks as an early working example. Insurance exposure stays tiny until agent-specific underwriting actually shows up.
What it owns
- These companies already ship products that grant, check and revoke agent authority across clouds and apps, which is the layer this take aims to own. · OktaIt sells identity that isn't tied to any one cloud, model or app, positioning it as a neutral layer to issue and revoke agent authority across vendors., ServiceNowIts AI Control Tower and Veza deal aim to set and audit what every agent can touch, including in apps it doesn't own, keeping control genuinely cross-environment., CrowdStrike HoldingsIt is adding runtime authorization through SGNL to decide in the moment whether a specific agent action is allowed, the action boundary this take aims to own., SailPointIt manages identity and access decisions across systems and is building agent governance with revocation in real time, a capability larger bundled vendors struggle to prioritize., Palo Alto NetworksThrough CyberArk, it owns privileged access and is extending that control to machine and agent identities instead of keeping it limited to human admins., Cisco SystemsIt is pairing Duo's agentic identity work with Astrix to find and control non-human identities, positioning itself closer to the cross-environment authority layer.57%
- These ship real action-level agent controls inside their own clouds, and Microsoft is the main risk that bundling squeezes the independents. · MicrosoftIt appears at meaningful size as the main bundling risk: Entra Agent ID could hand out agent identity inside products companies already pay for and squeeze independents., AmazonAgentCore lets it set policy on each action an agent takes in its cloud, enforcing authority where the action happens.15%
- Card networks already approve, limit and revoke agent spending per transaction, a smaller expression of the same architecture. · VisaIts agent spend controls enforce a user's limits at the payment, showing how the grant-and-revoke pattern works in the transaction domain., MastercardIts revocable agentic tokens give an agent payment authority that can be scoped and pulled back, applying the same pattern this take expects across domains.9%
- Someone has to watch what agents actually did and keep a record that proves they stayed inside the authority they were given. · DatadogIt watches what software actually does, creating the record proving an agent stayed inside its delegated authority for security teams and auditors.7%
- A very small bet that proof of agent authority becomes what insurers need to price agent risk, kept tiny until it shows up in real premiums. · AXIS CapitalIt has put capacity behind AI liability coverage, a small bet that agents become a risk category insurers will price distinctly., Verisk AnalyticsIt writes the standard policy language insurers use, so it would see agent-specific coverage taking shape early if liability underwriting emerges.3%
- Cash9%