Security teams were losing ground to hackers before AI entered the picture, and artificial intelligence has only widened the gap, according to a white paper and product launch from the Tide Foundation this week. The company introduced what it calls "emergent authority," a model where no person, system, administrator, or AI permanently holds security authority. Instead, power to control access and decrypt data appears only when identity, policy, context, and intent align, then vanishes again.
The challenge stems from a fundamental imbalance: defenders must be flawless at all times while attackers need only one success to breach a system, Tide co-founder Michael Loewy tells The New Stack. A single typo, misconfiguration, or poorly written code line can compromise even the largest corporations, which is why breaches dominate headlines daily. AI has intensified the problem by generating vast quantities of error-prone code that hasn't been adequately reviewed, even as advanced models grow increasingly adept at finding and exploiting weaknesses. Meanwhile, AI agents now write software and carry out sensitive, privileged operations. Once attackers bypass authentication and authorization, they inherit authority that exists in admin credentials, root keys, identity providers, and service accounts—power that always resides somewhere and remains accessible to someone.
Most organizations store application secrets, user credentials, and permissions centrally, then layer defenses like firewalls, key vaults, multi-factor authentication, and endpoint detection around that location, co-founder Ben Waters explains. Even bug-free code runs on someone else's cloud and operating system, creating dependencies that demand perfect patching and configuration everywhere, all the time. Waters says that core paradigm is broken, and Tide aims to fix it by using cryptography to compute authority in fragments that can't be reassembled. The company's goal is that when a breach occurs and an attacker gains root access to a server, nothing is there to steal because authority has been architecturally scattered elsewhere. Tide launched as an Internet of Things analytics platform a decade ago, sitting between brands and consumers' connected devices, before regulated customers demanded proof that breaches couldn't trigger GDPR fines or leak sensitive information—the infrastructure built to meet those demands became the product.
The developer product, TideCloak, replaces existing identity and access management systems and handles authentication, authorization, end-to-end encryption, and governance atop Tide's Cybersecurity Fabric, keeping consequential authority out of everyone's reach. On Monday, Tide released Raziel, an MCP server named after the archangel of secrets, that equips AI assistants with detailed knowledge of Tide authentication, threshold cryptography, encryption, and governance so coding agents can handle integration without developers reading extensive documentation. Rather than scanning for entry points, one of Raziel's prompts maps blast radius by assuming attackers are already inside and identifying what they'll find, where they can impersonate users, and where they can grant themselves access. Loewy notes this represents a rare security claim backed by capital: Tide partnered with a Lloyd's of London underwriter to offer preferential cyber insurance terms for organizations integrating TideCloak. The team compares its ambition to DNS, hoping Tide becomes infrastructure nobody owns but everyone benefits from—enabling developers to delegate real responsibility to AI agents, contractors, or small startups without creating dangerous insiders, what Loewy calls "coordination at scale without custody at scale." For developers and business leaders alike, the calculus remains straightforward: legacy architectures concentrate risk in ways that make perfect defense impossible, while distributed authority models shift the burden from perpetual vigilance to structural design. If threshold cryptography and emergent authority prove viable at enterprise scale, the constraint on AI-assisted development may shift from trust to imagination.