AI agents are getting increasingly capable at calling tools: issuing refunds, updating tickets, sending emails, modifying infrastructure, querying databases, and triggering deployment pipelines.
But there’s a security problem I kept coming back to:
Why should the agent itself possess the credentials needed to perform those actions?
If an agent has a Stripe key, GitHub token, cloud credential, or database password, then the security boundary is effectively inside the agent runtime.
I wanted to see if there was a cleaner way to decouple intent from execution, so I started building a small side project called Trust Gateway.
