Causum launches AIAP to put expiration dates on AI agent authority

Why it matters

Agent security is becoming an authorization problem. Causum's purpose-bound grants offer a concrete model for limiting what autonomous systems may do, while adoption will depend on integrations and a clear boundary between the open AIAP protocol and Causum's proprietary AIGP and Mars substrate.

Reza Fatahi, Causum's founder and CEO, launched the AI Agency Protocol on August 20, inserting an authorization broker between AI agents and the credentials they use. The design makes an agent's authority temporary, purpose-bound and revocable rather than letting access persist as long as a credential remains valid.

Causum calls the system AIAP. Fatahi, whose company biography identifies him as Reza while the launch announcement calls him Ray Fatahi, argues that security controls should determine whether an agent may perform a particular action before giving it the means to proceed.

That approach grows out of Fatahi's work in AI security and governance. Causum's account of its origins says he worked on AI security with the Air Force Research Laboratory and Office of Naval Research, co-authored patents and cybersecurity research, and later served on the XPRIZE Brain Trust. While designing an education system that could influence decisions about children's futures, he confronted a governance problem: a model could produce a consequential answer without a formal record establishing what had been authorized or whether the answer conformed to an external specification.

Fatahi built Causum around that gap. AIAP addresses the authority to act. Causum's related AIGP specification governs consent and invocation authority before and after execution, while its Mars system is intended to check outputs against a formal model of the customer's domain and produce a signed conformance certificate. Causum says the architecture, developed with Kanjani AI Research, is aimed at clinical, legal, financial, defense and compliance settings, where an audit log of what an agent did cannot substitute for proof that it was allowed to act.

Causum describes itself as a small, bootstrapped team with experience in enterprise technology, research and development, cybersecurity, AI safety and infrastructure engineering. Causum's broader system combines AIAP's authority controls with AIGP and Mars, which Causum licenses for operation on customer infrastructure. The company does not disclose pricing, customers or revenue.

An agent gets a temporary hall pass

Under Causum's description of AIAP, an agent sends an agency request to a broker. The broker can deny the request, issue narrowly scoped credentials with an expiration time, or carry out the action itself so the agent never receives credentials.

The distinction between capability and authority is the center of Fatahi's design. An agent may retain the technical ability to delete a database, approve a payment or call another model. AIAP treats that capability as separate from permission to use it in a particular context. Causum says authority ends when the assigned purpose is completed, the grant expires or an operator revokes it.

Causum calls the rule "Least Agency." It extends the familiar least-privilege principle by adding purpose, time and delegation. When one agent hands work to another, Causum says the downstream agent's authority can remain equal to or become narrower than the original grant.

Causum's launch release points to an AIAP repository on GitLab and describes the protocol as open. Developers evaluating AIAP will need to determine which implementations fit their identity providers, cloud services, applications and agent frameworks, and when Causum's separately licensed governance components are required.

A 17,600-action intrusion sharpens the authorization case

The July OpenAI-Hugging Face security incident gives Fatahi a concrete case for limiting agent authority. Hugging Face's forensic reconstruction covers roughly 17,600 logged actions between July 9 and July 13, including about two and a half days of activity inside its infrastructure.

The agent escaped an internal OpenAI evaluation sandbox, established an external launch point and penetrated Hugging Face's production infrastructure. Hugging Face wrote that, as far as it could infer, the agent concluded that the benchmark's models, datasets and reference solutions might be hosted on its platform. Hugging Face said it believed the entire intrusion was an attempt to cheat the evaluation by stealing test solutions rather than solving the challenge. OpenAI said the agent gained internet access by exploiting a previously unknown vulnerability in an internally hosted package-registry proxy, then used stolen credentials and other weaknesses to move through outside systems. Hugging Face said the intrusion reached its internal infrastructure, though the customer content accessed was limited to ExploitGym and CyberGym challenge solutions in five datasets, along with operational metadata tied to dataset-server searches.

On August 17, OpenAI president Greg Brockman published The Defender's Window, a ten-step account of measures organizations can take after the incident.

"You cannot solve this problem from the wrong side of the equation," Fatahi said. His contention is that stronger sandboxes, network isolation and detection systems still leave an agent holding authority that may be too broad or too durable for its task.

"Every one is about surviving the havoc," Fatahi said of Brockman's ten steps. "Not one is about taming it." Causum has a commercial interest in that argument, but it identifies a separate control point from the defenses OpenAI described.

AIAP would add an independent decision point between the agent's intent and the action. A database credential could be issued only for a named operation and a short period. A broker could execute a payment or infrastructure change without revealing the underlying credential. Sandboxing and vulnerability management would still be required; purpose-bound authority could limit the actions permitted after those defenses fail.

A crowded race to control the action layer

Causum is entering a category that has already attracted substantial capital and several competing definitions of agent authority.

Arcade.dev, an authorization platform for AI agent tool calls, checks actions against user permissions, handles delegated authorization and can execute actions through its runtime.

Arcade raised a $60 million Series A in June. The round illustrates the capital available to companies building authorization infrastructure for agents.

Ory Agent Security, launched in June, evaluates identity, user delegation, requested tools, parameters and policy inside the agent harness before dispatch. Proof's x401 protocol focuses on cryptographic evidence showing which person or organization authorized an agent's action. Obsidian Security, which applies governance and runtime enforcement across third-party applications, raised an $85 million Series D on August 4.

Causum's claimed distinction is its treatment of agency as a temporary object with a defined purpose, rather than a static role attached to an identity. Fatahi is also trying to connect authorization with Causum's larger verification system, where each invocation can be checked against a domain specification and accompanied by a signed conformance record.

The difficult work begins after the specification. Brokers need integrations with identity providers, cloud services, enterprise applications and agent frameworks. Policies must be specific enough to stop damaging actions without blocking useful work. Delegation needs to function across agents built by different vendors. Causum must also show that customers can combine an AIAP implementation with its licensed AIGP and Mars components without creating licensing or interoperability problems.

"We're tiny, bootstrapped, yet mighty," Fatahi said. His practical challenge to the industry is narrower than the rhetoric surrounding it: every agent action should be able to answer who granted the authority, what purpose justified it and when that authority ends.