Ian Livingstone is co-founder and chief executive of Keycard, which builds identity and access infrastructure for autonomous software agents. He focuses on a growing security problem: agents need meaningful authority to use enterprise systems and write software, but their permissions, actions, and human owners must remain accountable.
Livingstone co-founded Manifold, a platform for discovering and managing developer services, and served as its chief technology officer before Snyk acquired the company in 2021. He also co-founded Cape Privacy, previously known as Dropout Labs, which worked on privacy-preserving machine learning.
In 2019, he described TF Trusted, an open-source framework that combined TensorFlow Lite, Asylo, and Intel SGX secure enclaves to protect machine-learning models and inputs during inference. The project won a confidential-computing challenge organized by Google Cloud and Intel.
At Snyk, a CircleCI security incident reinforced the operational risks of static credentials: responding required organizations to identify and rotate secrets across interconnected systems. Livingstone subsequently founded Keycard with former Manifold and Snyk colleague Matthew Creager and Passport.js creator Jared Hanson. The company emerged publicly in 2025 with $38 million in combined seed and Series A funding and acquired Anchor.dev in February 2026, adding certificate-management expertise.
He also co-hosts The Infra Pod with Timothy Chen, interviewing the people building modern software infrastructure.
How he thinks about autonomous software
- Runtime identity instead of static secrets. Agents should receive short-lived, task-scoped credentials connected to a specific identity, policy, and human owner—not unrestricted logins, shared service accounts, or durable API keys.
- Security outside the model. Livingstone argues that increasingly capable, goal-seeking models cannot reliably enforce their own boundaries. Authorization belongs in surrounding infrastructure, where protected actions can be restricted and audited independently of model behavior.
- Human accountability for agent actions. Commits, production changes, and other automated work must remain attributable to the person or organization that authorized them. Existing development infrastructure often records a single actor; agent-driven workflows need stronger provenance linking human intent, software action, and resulting changes.
- Verifiable coding-agent loops. In a debate on autonomous coding workflows, Livingstone positioned agents as an acceleration of engineering’s existing feedback mechanisms, including tests, review, and continuous integration. He sees the clearest immediate opportunity in narrowly bounded work whose results can be checked.
- Access control for shared agent memory. Multiple agents need common context, but shared state introduces difficult questions about authorship, visibility, and permissions. Livingstone considers this an unresolved infrastructure problem for production multi-agent systems.
