Kamil Potrec

Kamil Potrec is product lead at Keycard, working on identity and authorization for AI agents. He is also a co-author of Agent Baseline, an open-source draft security framework that helps organizations define what agents may access, how their actions should be checked, and how to stop them when something goes wrong.

His background includes years in penetration testing and red teaming. He previously worked as a senior security engineer at Snyk, where his work included reviewing Terraform code and Kubernetes configurations for security weaknesses.

In his 2020 investigation of container isolation, Potrec tested an existing Linux kernel exploit inside Kubernetes. Gaining root privileges inside a container initially left the host’s files, processes, and network out of reach because Linux namespaces still isolated those resources. He then adapted the exploit to enter the host’s namespaces and access them. Applying a seccomp profile, which filters system calls, blocked that attack in his test even though the kernel remained vulnerable. He emphasized that such controls could buy time to apply a necessary patch.

Keycard introduced Keycard for Coding Agents in early access on March 19, 2026. The product evaluates tool calls routed through its integrations before they run and issues credentials scoped to the user, agent, task, and environment. A developer can retain read-and-write access to a database while their agent is limited to reading selected tables. Its delegation model also limits sub-agents to their parent’s permissions.

Potrec helped draft Agent Baseline with engineers from Keycard, Docker, and Snyk. Published on July 30, 2026, the initial draft defines six security outcomes and 35 proposed controls. Teams can use it to examine the whole system around an agent: its dependencies and network access, the scope of its permissions, checks on its behavior, and the records needed to reconstruct an incident. Its response requirements include both stopping execution and removing active permissions, addressing access that can remain after a run has stopped.

His approach to agent security emphasizes:

• Keep the agent’s identity attached to its actions. A service account can explain how a request reached a system without identifying which agent chose the action, what task it was pursuing, or who delegated the work. Potrec argues that this context must travel with the request across systems so an action can be authorized and later traced to its origin.

• Check consequential actions independently. In his earlier security work, a second reviewer could catch mistakes before they caused damage, but reviewing every step was often too costly. He argues for checks before consequential actions take effect, independent of the agent’s own reasoning and backed by limits on what it can reach.

• Define the task before enforcing its limits. Security controls inherit the scope an organization gives them. A goal such as “capture the flag” leaves essential questions unanswered unless it names the permitted environment, targets, and actions. Potrec places responsibility for those choices with the organization deploying the agent; security tools cannot decide whether the chosen scope was appropriate.