Tide launched Raziel for AI security. It assumes hackers are inside.

Tide Foundation co-founder Michael Loewy explains that the security industry has been behind hackers even before AI became a concern for developers. He states that before AI, developers and platform owners had to be flawless in terms of patching, error-free code, and absence of bugs, as attackers needed only one correct action to gain access.

However, AI has exacerbated the risks, as vast amounts of inadequately reviewed and error-prone code are being generated while advanced AI models become proficient at identifying and exploiting vulnerabilities. AI agents not only perform sensitive actions but also acquire authority within systems, controlling who can access data and assign permissions.

Loewy and co-founder Ben Waters are particularly worried about the authority agents gain once inside a system, as it involves decisions about granting access and decrypting data. To address this, Tide has developed a model called "emergent authority," where authority is generated only when identity, policy, context, and intent align, rather than being permanently held by individuals, systems, or AI.

This approach involves distributing authority across multiple pieces using cryptography, making it impossible for attackers to reassemble it if they breach a system. Tide's solution, TideCloak, is designed to work alongside existing identity and access management systems, handling authentication, authorization, end-to-end encryption, and governance.

The company has also released Raziel, an MCP server that assists AI assistants in understanding Tide's authentication, threshold cryptography, end-to-end encryption, and governance. Raziel helps developers decide between self-hosted or managed hosting and generates verified playbooks for integration, aiming to make the security apparatus seamlessly integrated into existing projects.