Atsign's Kill Switch for AI Agents Isn't Software. It's an Identity You Can Revoke.
Most conversations about AI agent security start with permissions: what an agent is allowed to touch, and how to stop it if it goes wrong. Atsign, an AI infrastructure and agentic identity platform, starts somewhere else entirely — with the idea that the network itself shouldn't have anything worth attacking in the first place.
"We have open ports where there is nothing of value, and where there are things of value, the ports are closed," said Gary Casey, Atsign's principal software engineer, describing the company's core protocol. "That's why we say it's zero trust connectivity with no open ports."
Every entity on Atsign's platform — a person, a device, an agent, a service — gets its own cryptographic identity, called an Atsign, resolved through a lookup system Casey compared to DNS: query an Atsign, get back an encrypted address to talk to directly, peer to peer, with no central server ever holding the data or the keys that protect it. "We don't want to be in a position ever where we are looking after somebody's secrets," Casey said. "That's not our purpose."
Why this doubles as a kill switch
That architecture has a direct payoff for anyone running AI agents in production right now: identity, not code, becomes the mechanism for shutting one down. Atsign's permission model — internally called APKAM, for application-level public key authentication mechanism — lets a single Atsign hold thousands, even millions, of separately scoped identities underneath it, each with access to only a narrow slice of a namespace. Compromise or misbehavior in one doesn't cascade to the rest. "If you have 1,000 agents and they're all doing different things, you don't want the compromise of one to lead to damage to anything else," Casey said. Revoking a single agent's access is immediate, and doesn't touch any other agent's ability to keep working.
CEO Aparna Rayasam framed the implication directly: "We think that this should be the de facto solution for kill switches for AI." Her pitch to the industry is blunt about who should be paying attention. "We think that almost every LLM provider should partner with us, so that we can make this easier for their customers."
The model also supports agents that are designed to disappear on their own. Casey described spinning up an agent with access to a specific namespace for five minutes, after which access expires automatically — no lingering credential, no forgotten process quietly running up an LLM bill long after its job is done.
Identity answers who. Policy answers whether it makes sense.
Scoped identity only solves part of the problem, and Casey was clear-eyed about where the rest of it lives: in a separate policy layer that evaluates whether a given request should actually be allowed, chained across however many hops an agent-to-agent interaction spans. His example: one agent asking another to approve a $50,000 payment on a person's behalf. Before that happens, something has to check whether the request is legitimate, whether the human it claims to represent actually authorized it, and whether a cryptographic chain of identity can prove the request really originated where it says it did — even ten steps removed from the original ask. "It shouldn't be hard-coded into agents," Casey said. "It should live in a policy world."
Deliberately, none of this runs through a central hub. Policy decisions can be delegated at whatever granularity an organization wants — one policy service for a small team, another for a larger division — but Atsign's architecture doesn't assume, or require, one authority sitting in the middle. Casey drew a sharp distinction for what that buys an organization under attack: "You can disrupt, but you can't compromise." Someone can still sever a connection. What they can't do is decrypt what was flowing through it.
What it actually takes to adopt
For engineering teams sizing up the lift, Casey's answer was straightforward: "It's entirely — run it on top of what you've got. It doesn't require anything else. It's literally you just run the software." No network-level changes, no separate infrastructure to stand up first. The SDK — most mature in Dart, with enterprise-grade Java and Python engines explicitly optimized to meet developers building autonomous AI applications — handles key management, encryption and decryption, offline sync, and event notifications.
Key management itself has no central authority by design. "They all do it themselves," Casey said of key generation and rotation — cut and rotated at the edge, published to each identity's own server, with no centralized key store required and, in Casey's view, none recommended at scale. Compromise response follows the same logic: revoking an agent's access also triggers key rotation across anything that shared its namespace, giving Atsign what Casey called post-compromise security — the damage is contained going forward, even though nothing can undo what a compromised key already read.
Getting ahead of the quantum deadline without betting on any one algorithm
Atsign is currently transitioning its post-quantum cryptographic support from targeted enterprise preview to production-grade deployment targets. The engineering choice Casey described as the hardest part wasn't a specific algorithm — it was building a pluggable provider model into the SDK that keeps the protocol itself agnostic to whichever encryption scheme is running on top. "Our protocol, our atServers and all that stuff, is completely agnostic to any of this stuff," Casey said. "They're just shipping bytes around the place. The crypto agility and all of the encryption and decryption is a client-side concern." Atsign isn't implementing cryptographic algorithms itself — it's relying on established, well-scrutinized libraries and adopting NIST- and IETF-blessed standards as they're finalized, aiming to plug new ones in and retire old ones quickly rather than committing hard to any single implementation.
That flexibility matters for reasons beyond the quantum timeline alone. Casey pointed to recent research using AI models to probe for weaknesses in AES, the current gold standard for symmetric encryption, as a reminder that classical cryptography itself isn't static ground. "My level of terror changes from day to day," he said. "This crypto agility is incredibly important" — not just for the eventual post-quantum transition, but for whatever comes next after that.
The next phase beyond the current rollout is post-quantum group communication, using PQMLS to bring forward secrecy to multi-party conversations at scale — an extension of the peer-to-peer model the platform runs on today. The IETF has ratified MLS itself; the post-quantum version is still working its way through standardization.
Casey echoed a view that's increasingly common across this year's Black Hat pre-show conversations, agreeing with the prediction others have made that most large enterprises will have a dedicated cryptography lead within the next few years — not necessarily a research mathematician, but someone whose job is specifically understanding the cryptographic landscape well enough to make these calls. "I would never call myself a cryptographer," he said. "But I would say at this point I kind of understand the landscape."