One machine is a complete compromise
Whoever controls a host inherits everything that host could ever do. There is no boundary between running software and the authority it exercises.
Coexisting with AGI is an infrastructure problem.
Keelson Labs was founded on a single bet: that the durable defense against adversaries operating at machine speed is not smarter software, but explicit, bounded, independently enforced authority, and that physical devices are what make presence and independence real.
Compromise does not confer authority.
Keelson Labs builds the authority layer for critical infrastructure. A compromised application or AI agent cannot enlarge the authority explicitly delegated to it, because that authority is enforced on hardware the host cannot administer or rewrite, with a human step no remote attacker can supply.
The problem
The stack made authority ambient.
Three trades that were fair when attackers were scarce and slow. All three fail under attack at machine speed and machine scale.
Ambient authority
Labels, not enforcement
A safe method is only a claim
HTTP marks reads safe and writes unsafe, but nothing enforces that a safe request has no consequence, or that an unsafe one stays in bounds. A perfectly encrypted channel carries a perfectly authenticated malicious instruction.
Monoculture
One exploit, millions of machines
Every Linux box, browser and TLS stack is identical. A memory-corruption bug, the bulk of what automated fuzzing finds, transfers wholesale.
AI changes the attacker’s economics, not the defender’s. The adversary to design for has money, human collaborators, legitimate hardware, and control of an already-authorized application host. What it still cannot do is create authority it was never delegated, provided that authority is enforced somewhere it cannot reach.
Why now
Attacks already run at machine scale.
80–90%
of a state-sponsored cyber-espionage campaign was executed by an AI agent, against roughly thirty targets including financial institutions and government agencies, with humans at four to six decision points.
Anthropic, November 202510,000+
high- or critical-severity vulnerabilities found by a single frontier model in its first month, in systemically important software, at a 90.6% true-positive rate.
Project Glasswing, May 2026150
critical-infrastructure operators across 15 countries were given that model in June 2026, because the bottleneck is no longer finding flaws; it is human capacity to patch them.
Anthropic / CyberScoop, June 2026When patching cannot keep up, the only defense left is an architecture in which compromise does not confer authority.
The insight
Understanding grants nothing.
You cannot build software an AI is unable to understand. You can build infrastructure where understanding is worth nothing, because nothing the host understands is authority. Reading public data stays free. Causing an effect requires authority that is:
01
Explicit
Every grant names the action, the resource, the limits and the lifetime. Nobody “has admin.”
02
Bounded
Per-resource envelopes over records, recipients, instances and duration. Delegation only ever shrinks.
03
Independently enforced
Admitted by a controller on hardware the host cannot rewrite, reading its own sensors rather than the host’s.
04
Attributable
A named principal stands behind every effect. Every grant has an owner, and the ledger records what was spent.
Physical devices supply the two things software alone cannot: presence, a human action a remote attacker cannot fake, and independence, an enforcement board the host cannot rewrite. They protect the authority model. They are not a substitute for it.
The product
A card in a person’s hand and a box the servers cannot reprogram.
The effect card
One token per press
A non-exportable key in a secure element, registered to a named principal. It releases a single challenge-bound, expiring token on a physical press or tap, valid for one controller domain and one short epoch, and useless anywhere else.
The effect controller
Four checks, its own ledger
A sealed appliance on a proven microkernel, on its own board. For every proposal it checks grant, token, budget and state, reading its own sensors, never the host’s. Its ledger is the source of truth. Updates come only through a physically gated path.
Every ingredient exists today. FIDO2-style presence, chip cards, seL4, evaluated hardware roots, data diodes. Keelson Labs composes them into one authority layer and makes it the default for consequential operations.
Positioning
What we are, and what we are not.
✓We enforce an effect boundary.
×Not OT visibility. Dragos, Claroty and Nozomi detect. They do not give a compromised network a physical reason it cannot act.
✓We gate effects against grants and envelopes.
×Not an HSM. HSMs protect keys. A correctly signed instruction is still an instruction.
✓We run outside the host.
×Not a software policy engine. A compromised host can rewrite software. It cannot rewrite a board it cannot reach, or press a button it does not hold.
✓We are registered and attributable.
×Not an anonymous token. For enterprise grants, auditability is the feature; unlinkability is not wanted.
Next
We are selecting design partners for the first gate.
One protected operation, one enforcement boundary, and an outside red team holding root on the host. If you run a gate where a wrong action costs more than a new stack, we would like to hear about it.