Give the work.
Never the keys.

The first time I used an agent, I was working on a Python project. At some point it needed a key, and I thought: do I give it to it? Honestly, I didn't hesitate much. I gave it. I had spent hours watching it code in the console on my own computer — reading files, writing code, running commands, fixing its own errors in front of me. It all felt local, close, under control. My brain mistook visibility for safety.

The console can sit on your computer, but that does not mean everything behind it stays there. The code, the credentials, and the context can cross models, servers, and providers you cannot see. Afterward, all that is left is to trust that no one logs them, leaks them, or uses them beyond what you expected.

Humanity has always had this problem: how to trust enough to act. Religions used sacred texts; kingdoms used scribes and archives; states used laws, censuses, and courts. We have always needed some mechanism to establish what happened, who may do what, and what follows when someone breaks the rules.

The trouble begins when whoever controls the record also controls its interpretation and its enforcement. Every person, company, and institution acts from its own interests and from the information it holds. Mathematics offers something different: it lets you check certain rules without depending entirely on an authority's word. It does not remove trust, but it shrinks what we must accept blindly. Try bribing a theorem, and tell me how it goes.

This matters most with AI agents. Agents will not stop at answering questions. They are writing code, running infrastructure, moving money, changing databases, and operating real systems. And yes — we will likely pass through a valley where AI is smart enough to do real-world harm, but not yet smart enough to see the big picture: to know when to stop and when to go. Putting rules on what it can and cannot do is a seatbelt on a car going 250 km/h. The better safety is that it knows when to accelerate, when not to, and under what conditions — and that we build roads, systems, where a crash stays contained.

So it is not enough to build a smarter or better-aligned model. Take the best model there is, train it on the best data, review it with the best teams — the day it errs, and it will, the damage is exactly the size of what you handed it. Hand it everything, and the most it can destroy is everything. And, the contrary view: the fault is not all the model's; it is the system's. If you think handing a single model all the responsibility should solve everything, that is the wrong question. Maybe one day. But we are talking about the road between point A, the old world, and point B, a model intelligent and aware enough to travel it alone. Until then it is a child that needs a seatbelt for the trip.

The mandate is set before the agent begins. The agent works inside those limits, but it cannot widen them, negotiate them, or reinterpret them on its own. Authorization does not depend on asking the model whether it thinks an action is allowed — that would return us to the same problem. We do not want the agent to be, at once, the one who acts, the one who reads the rule, and the one who decides it was met. We want to separate the power to act from the power to authorize.

Large companies already use secret managers, KMS, HSMs, IAM policies, execution enclaves, TEEs, and technologies like Intel SGX. All of it helps, but protecting a key does not, by itself, solve the problem. At some point someone has to use it. An agent has to call an API, sign an operation, run an action. And the real questions come back: who authorized that action, what limits it had, whether the key could be used for something else, and whether the provider can later change the record of what happened.

That is why the permissions live on Ring0, a blockchain that records who authorized the agent, what it may do, and until when. No one — not even us — can change those rules without leaving a trace.

We are not trying to build machines that cannot err. We are building systems where erring does not mean losing everything. Power is lent bounded, exercised in the open, and returned.

Give the work. Never the keys.