Edera introduces credential-free permissions for AI agents

Separating permissions from credentials

Edera announced the technology on Nov. 5, 2026, describing it as the latest capability in its Agent Runtime suite. The approach uses object capabilities and enforcement by the hypervisor to separate what an agent can do from the credentials normally required to perform an action.

Under the model, platform and security teams can grant a workload narrowly defined capabilities while keeping sensitive tokens outside the workload. Edera gives the example of an AI coding agent authorized to work within a single GitHub repository without holding a GitHub token. The capability can also limit the agent to a specific set of GitHub actions, even when the underlying token has broader access.

Edera says this could reduce the impact of a compromise caused by prompt injection. If an agent is compromised, its permissions remain confined to the defined repository and there is no credential inside the workload for an attacker to steal.

Capabilities cover APIs, commands and files

Edera's Agent Runtime combines hardware-isolated execution with object capabilities. Its announced capabilities include credential-free API access through capcurl, with a separate broker retaining the underlying credentials. The company also describes scoped command execution through capsudo, allowing workloads to run specific privileged commands without receiving standing administrative access.

Integration with SPIFFE/SPIRE is intended to provide cryptographically verified workload identities and mutual TLS without requiring long-lived secrets inside an agent. Other capabilities include per-tenant sandbox configurations, auditable agent actions and granular file system controls that limit workloads to the files and resources needed for their assigned tasks.

According to Edera, these capabilities are designed to replace custom credential-handling and permission logic that engineering teams often build and maintain themselves. The company says the system can complement workload isolation: isolation limits damage to neighboring infrastructure, while object capabilities restrict the authority a compromised workload can exercise.

Applications extend to MCP servers

Edera says the approach also applies to Model Context Protocol servers, which connect AI models to enterprise tools, commands and APIs. Because these servers can operate with access to sensitive credentials and infrastructure, the company describes them as potential high-value targets for attackers.

With object capabilities, organizations can define which commands an MCP server may execute and which external resources it may access without granting unrestricted access to underlying systems. Ariadne Conill, Edera co-founder, distinguished engineer and Alpine Linux maintainer, said, “Object capabilities let us separate the action from the authority behind it, so agents can do useful work without becoming a security liability.”

Edera is developing Bounded Authority as part of its broader effort to secure AI agents on Kubernetes. Initial Agent Runtime functionality includes scoped command execution and workload identity, while credential-brokered API access and deeper integrations are still under development.