What is the Keycard Lockbox raffle agent?

It's a live demo at RSAC where an AI runs event raffles using Keycard for policy-governed, ephemeral access to data tools—no standing creds, just single-use tokens per action.

Can you really rig an AI raffle like this?

The demo invites it: tell the agent to delete all but one entry. HITL and policy block it independently, showing dual safeguards even if humans slip.

How does Keycard prevent AI agent breaches?

Every tool call requests fresh, scoped creds via token exchange (RFC 8693). Policies deny out-of-scope requests pre-issuance; tokens discarded post-use.

🤖 AI Dev Tools

Rigging an AI-Run Raffle at RSAC: Keycard's Lockbox Fights Back

Over 500 RSAC attendees entered an AI-powered raffle for Flipper Zero and Mac Minis. Then someone tried to delete every entry but one to guarantee a win—Keycard's policies said no.

theAIcatchup Apr 08, 2026 4 min read

Keycard Lockbox UI showing locked state during AI raffle entry at RSAC booth

⚡ Key Takeaways

Keycard's Lockbox demo uses ephemeral, single-use credentials to secure AI agent tool calls. 𝕏
Dual gates—human approval and policy checks—block rig attempts like deleting raffle entries. 𝕏
This architecture previews zero-trust for agent swarms, predicting mandatory adoption by 2026. 𝕏

Published by

theAIcatchup

Ship faster. Build smarter.

#Keycard

Worth sharing?

Get the best Developer Tools stories of the week in your inbox — no noise, no spam.

Originally reported by dev.to

⚡ Key Takeaways

The 60-Second TL;DR

theAIcatchup

Share this article

Worth sharing?

Related Stories

One Forgotten Line: How Anthropic Handed Rivals Their $340 Billion AI Crown Jewels

OpenClaw's Rogue Shell Commands: Why Your AI Agent Could Betray You

Your AI Agent's Toolkit Just Got a Sneaky Security Guard: Enter asqav-mcp's Prompt Injection Scanner

AI Agents Turn Traitor: This Week's Security Alarms That'll Haunt Devs

Stay in the loop