🔐Edera Launches Object Capability Bounded Authority to Strip Secrets From AI Agents

Your AI agents shouldn't hold your credentials anymore

Edera just shipped a way to run AI agents without handing them your secrets. Its new security model, Object Capability Bounded Authority, enforces granular permissions at the hypervisor level, so autonomous workloads and Model Context Protocol servers never touch sensitive credentials directly. If you're wiring up coding assistants or agent pipelines, this is the part to care about. Today most container security is boundary isolation plus static secrets dumped into environment variables or config files. One compromised agent means everything it can reach is compromised too. Edera's pitch: an agent gets narrowly defined capabilities, like modifying a single GitHub repository, with no personal access token in sight. The initial release covers scoped command execution through capsudo and workload identity verified with SPIFFE and SPIRE integrations. Credential-free API access via capcurl routes requests through an isolated broker. Credential-brokered API access and deeper orchestrator integrations are still coming under the broader Project Lunchbox initiative. The team was led by Edera co-founder and distinguished engineer Ariadne Conill.