Every era of computing separated authority from execution. AI is next.
For the first time, software does not just execute instructions. It decides what to do next. Agents choose their next move from context, at runtime, in production, against real systems, with real consequences.
That breaks the assumption every existing control was built on. Identity systems define who has access. Security systems inspect traffic. Observability systems record what happened. None of them govern execution itself. When decision-making and execution collapse into the same runtime, the agent effectively becomes its own authority. That model does not scale, and no amount of prompt engineering makes it scale.
Computing has solved this problem before, the same way each time.
user space to kernel
When programs grew untrusted, the kernel was separated out and applications stopped touching the machine directly.
users to permissions
When systems outgrew local logins, permissions were lifted out of the user and identity became its own plane.
workloads to orchestration
When workloads multiplied beyond hand-tending, orchestration was separated out and workloads stopped deciding where they ran.
agent to authority
When software started deciding what to do next, the agent needed its authority lifted out. That is what we are building.
Each time, authority was lifted out of the thing that executes. AI needs the same move.
Firma is that layer. Every call an agent makes passes through an enforcement point that classifies the action, evaluates it against policy the organization owns, and allows or denies it before it happens, producing a signed record either way. Deterministic, local, and structural: it does not depend on the agent’s cooperation, and it holds when the agent is compromised.
The future of AI will not be defined only by smarter models. It will be defined by whether autonomous systems can be trusted to operate in the real world.
Firma is Italian for “signature.” Every decision the runtime makes is signed.